GHSA-w2x5-gv52-9ccv — Sakai Conversations has a Stored XSS Issue

Affected: Maven: org.sakaiproject.conversations:sakai-conversations-impl, Maven: org.sakaiproject.kernel:sakai-kernel-impl, Maven: org.sakaiproject.rubrics:rubrics-impl

### Summary

The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's `unsafeHTML()` directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post.

### Description

The Conversations REST API endpoint `POST /api/sites/{siteId}/topics` accepts a `message` field in the JSON request body. The service layer (`ConversationsServiceImpl`) stores the message directly to the database (`conv_topics.MESSAGE`) without invoking `FormattedText.processFormattedText()` or any equivalent HTML sanitizer.

The same issue affects post replies via `POST /api/sites/{siteId}/topics/{topicId}/posts` and comments stored in `conv_comments`.

On the frontend, `SakaiTopic.js`, `SakaiPost.js`, and `SakaiComment.js` all render the `message` field using LitElement's `unsafeHTML()` directive:

- `SakaiPost.js` lines 429, 432: `${unsafeHTML(this.post.message)}` - `SakaiTopic.js` line 679: `${unsafeHTML(this.topic.message)}` - `SakaiComment.js` line 148: `${unsafeHTML(this.comment.message)}`

Unlike other Sakai tools (Announcements, Assignments, Resources) which call `FormattedText.processFormattedText()` before persisting user content, the Conversations implementation has no equivalent protection at storage time or render time.

##…

Most recent entries from all

GHSA-w2x5-gv52-9ccv — Sakai Conversations has a Stored XSS Issue