Details
-
Bug
-
Resolution: Unresolved
-
Major
-
None
-
18.8.0
-
None
-
Unknown
-
Description
The Id macro accepts any value for its name parameter and outputs it as the HTML id attribute without any check, so it silently produces anchors that no link can reach.
Steps to reproduce
Create a page with each of these calls and view it:
- {{id name=""/}}
- {{id name="my anchor"/}}
Expected
An invalid id is rejected with an error that names the name parameter and says what a valid id is, a non-empty value without whitespace.
Actual
The macro renders id="" and id="my anchor", which are invalid HTML ids, with no message.
Proposal
- Declare the format of name in IdMacroParameters, for example with a @Pattern constraint, so that an invalid value fails the parameter validation.
- Once XWIKI-25287 is done, the Edit Macro dialog can also reject it before the macro is saved.
Found while auditing the Id macro: https://design.xwiki.org/xwiki/bin/view/Proposal/WYSIWYGusabilityofXWikimacros/Macros/id/
Attachments
Issue Links
- relates to
-
XWIKI-25287 The Edit Macro dialog doesn't enforce the constraints declared on the parameters of Java macros
-
- Open
-