Uploaded image for project: 'XWiki Rendering'
  1. XWiki Rendering
  2. XRENDERING-821

The Id macro accepts empty names and names with whitespace

    XMLWordPrintable

Details

    • Bug
    • Resolution: Unresolved
    • Major
    • None
    • 18.8.0
    • Macro - Id
    • None
    • Unknown

    Description

      The Id macro accepts any value for its name parameter and outputs it as the HTML id attribute without any check, so it silently produces anchors that no link can reach.

      Steps to reproduce

      Create a page with each of these calls and view it:

      1. {{id name=""/}}
      2. {{id name="my anchor"/}}

      Expected

      An invalid id is rejected with an error that names the name parameter and says what a valid id is, a non-empty value without whitespace.

      Actual

      The macro renders id="" and id="my anchor", which are invalid HTML ids, with no message.

      Proposal

      • Declare the format of name in IdMacroParameters, for example with a @Pattern constraint, so that an invalid value fails the parameter validation.
      • Once XWIKI-25287 is done, the Edit Macro dialog can also reject it before the macro is saved.

      Found while auditing the Id macro: https://design.xwiki.org/xwiki/bin/view/Proposal/WYSIWYGusabilityofXWikimacros/Macros/id/

      Attachments

        Issue Links

          Activity

            People

              Unassigned Unassigned
              Lucas C Charpentier Lucas
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

              Dates

                Created:
                Updated: