This issue has been created
 
 
XWiki Rendering / cid:jira-generated-image-avatar-6c524327-79ef-432f-b5e6-ff72d6a9bfe6 XRENDERING-821 Open

The Id macro accepts empty names and names with whitespace

 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-ed5b326c-0223-4836-b612-5cd129324231 Charpentier Lucas created this issue on 16/Oct/26 16:45
 
Summary: The Id macro accepts empty names and names with whitespace
Issue Type: cid:jira-generated-image-avatar-6c524327-79ef-432f-b5e6-ff72d6a9bfe6 Bug
Affects Versions: 18.8.0
Assignee: Unassigned
Components: Macro - Id
Created: 16/Oct/26 16:45
Priority: cid:jira-generated-image-static-major-298be204-effd-44af-8362-3d905b32d3d1 Major
Reporter: Charpentier Lucas
Description:

The Id macro accepts any value for its name parameter and outputs it as the HTML id attribute without any check, so it silently produces anchors that no link can reach.

Steps to reproduce

Create a page with each of these calls and view it:

  1. {{id name=""/}}
  2. {{id name="my anchor"/}}

Expected

An invalid id is rejected with an error that names the name parameter and says what a valid id is, a non-empty value without whitespace.

Actual

The macro renders id="" and id="my anchor", which are invalid HTML ids, with no message.

Proposal

  • Declare the format of name in IdMacroParameters, for example with a @Pattern constraint, so that an invalid value fails the parameter validation.
  • Once XWIKI-25287 is done, the Edit Macro dialog can also reject it before the macro is saved.

Found while auditing the Id macro: https://design.xwiki.org/xwiki/bin/view/Proposal/WYSIWYGusabilityofXWikimacros/Macros/id/