CVE-2026-54049

### Summary The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's `unsafeHTML()` directive, resulting in stored cross-site scripting (XSS). Any authenticated user with access to a site that has the Conversations tool enabled can inject arbitrary HTML and JavaScript that executes in the browsers of all other users who view that topic or post. ### Description The Conversations REST API endpoint `POST /api/sites/{siteId}/topics` accepts a `message` field in the JSON request body. The service layer (`ConversationsServiceImpl`) stores the message directly to the database (`conv_topics.MESSAGE`) without invoking `FormattedText.processFormattedText()` or any equivalent HTML sanitizer. The same issue affects post replies via `POST /api/sites/{siteId}/topics/{topicId}/posts` and comments stored in `conv_comments`. On the frontend, `SakaiTopic.js`, `SakaiPost.js`, and `SakaiComment.js` all render the `message` field using LitElement's `unsafeHTML()` directive: - `SakaiPost.js` lines 429, 432: `${unsafeHTML(this.post.message)}` - `SakaiTopic.js` line 679: `${unsafeHTML(this.topic.message)}` - `SakaiComment.js` line 148: `${unsafeHTML(this.comment.message)}` Unlike other Sakai tools (Announcements, Assignments, Resources) which call `FormattedText.processFormattedText()` before persisting user content, the Conversations implementation has no equivalent protection at storage time or render time. ### Proof of Concept **Setup:** Admin/instructor session on a site with the Conversations tool enabled (siteId `BELP_275K_7418`). **Step 1 - Inject XSS payload in topic:** ``` POST /api/sites/BELP_275K_7418/topics HTTP/1.1 Host: localhost:9107 Cookie: SAKAIID=<authenticated-session> Content-Type: application/json {"title":"XSS Test Topic","message":"<img src=x onerror=alert(1)>","type":"QUESTION","visibility":"SITE","draft":false} ``` Response: HTTP 200, `"message":"<img src=x onerror=alert(1)