The custom report displays its own macro calls when a filter value ends with a tilde

Problem

The report page ReleaseNotes.Code.Report builds its getChanges and displayChanges calls by concatenating each filter value into a quoted macro parameter. It sanitises the value by removing the quote characters from it, but not the tilde, which is the escape character of the XWiki 2.1 syntax.

A filter value ending with a tilde therefore escapes the closing quote of the parameter it sits in. The macro call no longer parses, and the report page displays the two calls as literal text instead of displaying the changes.

Every filter is built the same way, so any of products, versions, audience, categories, importance, containsScreenshots and displayer does it.

How to reproduce

Open the report with a filter value ending in a tilde:

/xwiki/bin/view/ReleaseNotes/Code/Report?action=report&products=XWiki~

The page displays this instead of the report:

{{getChanges  products='XWiki'  limit="20" offset="0" contextVariable='reportChanges'/}}
{{displayChanges  products='XWiki'  contextVariable='reportChanges'/}}

Not an injection

A filter value cannot break out of the parameter it sits in and have the rest of it parsed as wiki syntax: a closing macro delimiter inside a quoted parameter value does not terminate the macro, a backslash does not escape the quote, and the value cannot carry a quote of its own since those are removed. The macro simply stops parsing. The result is a broken page, not injected content.

Fix

Escape the value with $services.rendering.escape($parameterValue, 'xwiki/2.1') instead of removing characters by hand, which is the escaping RN-101 already applied to the product and version values that the release notes changes macro passes to the very same macros.