Uploaded image for project: 'XWiki Rendering'
  1. XWiki Rendering
  2. XRENDERING-815

XWiki syntax renderer doesn't escape closing macro syntax in various attributes

    XMLWordPrintable

Details

    • Unknown

    Description

      Steps to reproduce:

      1. Open the WYSIWYG editor on any page
      2. Insert an information box
      3. Inside the box, insert an image
      4. Set {{/info}} as alternative text of the image
      5. Save the page.

      Expected result:

      The image is displayed inside an information box with the selected alt text.

      Actual result:

      No image is displayed, instead

      "]]
      {{/info}}
      

      is displayed:

      This is because the closing info macro syntax isn't escaped inside the attribute of the image and then the parser treats this as the closing tag of the macro. The same issue exists in inline and block-level parameter syntaxes, link parameters, link and image references both with full syntax and freestanding and the ID event (which has no escaping at all, but also cannot be triggered through WYSIWYG).

      This is an issue because the xwiki/2.x macro content scan looks for {{/name}} without any regarding for the construct the marker appears in. This corrupts content on any render-parse roundtrip like in WYSIWYG editing.

      Attachments

        Activity

          People

            MichaelHamann Michael Hamann
            MichaelHamann Michael Hamann
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated: