Details
-
Bug
-
Resolution: Unresolved
-
Major
-
16.10.0
-
None
-
Unknown
-
Description
Steps to reproduce:
- Open the WYSIWYG editor on any page
- Insert an information box
- Inside the box, insert an image
- Set {{/info}} as alternative text of the image
- Save the page.
Expected result:
The image is displayed inside an information box with the selected alt text.
Actual result:
No image is displayed, instead
"]]
{{/info}}
is displayed:
This is because the closing info macro syntax isn't escaped inside the attribute of the image and then the parser treats this as the closing tag of the macro. The same issue exists in inline and block-level parameter syntaxes, link parameters, link and image references both with full syntax and freestanding and the ID event (which has no escaping at all, but also cannot be triggered through WYSIWYG).
This is an issue because the xwiki/2.x macro content scan looks for {{/name}} without any regarding for the construct the marker appears in. This corrupts content on any render-parse roundtrip like in WYSIWYG editing.