Security
This page aims at listing both the design decisions that have been taken in XWiki Standard and that developers and users should be aware.
It will also list the specific things that a developer should be careful with to avoid introducing new vulnerabilities.
Security design decisions
Script Right
Several features of XWiki requires Script right to work: it's true for backend scripts, but it's also true for frontend scripts (i.e. JavaScript).
This decision for needing a specific right for those things is directly linked to the capability of a user to perform various kind of attacks by using those scripts: administrators should never give this right lightly. At least for now, script right provides ways, e.g., through JavaScript, to execute actions in the name of the current user. This might be fixed in the future as this is not the idea of script right but for now, take this into account when granting script right to a user. As a best practice, instead of using scripting macros and JavaScript in a lot of pages, create wiki macros that encapsulate these scripts and load the necessary JavaScript code.
Security by default
Developers must ensure that XWiki has secure configurations by default (without the user having to change configuration).
Technical aspects
All technical aspect is located in the Security page of the developer guide