Details
-
Improvement
-
Resolution: Unresolved
-
Major
-
None
-
13.10.9
-
None
-
Unknown
-
Description
It's currently very tedious to perform a proper syntax of some elements in XWiki, and so we should provide helpers to ease life of developers and avoid vulnerabilities in our code.
Some helpers that are needed:
- capability to escape labels of wiki links (double escape)
- capability to escape wiki syntax used with a translation:
## Example of creating a link from a translation like "translation=my {0}link label{1} #set ($myLink = $services.localization.render('translation', ["__BEGINLINK__", "__ENDLINK__"])) #set ($myLink = $services.rendering.escape($myLink, "xwiki/2.1")) #set ($myLink = $myLink.replace($services.rendering.escape("__BEGINLINK__", "xwiki/2.1"), "[[")) #set ($myLink = $myLink.replace($services.rendering.escape("__ENDLINK__", "xwiki/2.1"), ">>$linkTarget]]")) $myLink