Notifications macro fails to display notifications for a space with an ampersand in the name

6 comments

Vincent Massol on 04/Dec/25 17:10

I think it's a regression from ~~XWIKI-17052~~ which modified https://github.com/xwiki/xwiki-platform/commit/f490e0b28e9f9aa755ef26c293f85452ac1a0db9#diff-df6b621d8b03f4a097acf7d488c8f1d0f0a564637113d346c58b0da1983b8476R1117-R1137

I'm not sure why there's the need to XML-escape the parameters passed to $services.notification.sources.getNotificationParameters($parameters). They are needed to be escaped for the HTML part for sure but for the java part, I don't see the need.

The problem is that it transforms the A&B value for spaces into: A&B which doesn't exist as a space... It would also break for any XML character that needs escaping and that it part of a space name...

	Vincent Massol on 04/Dec/25 17:13

	I think it's a regression from XWIKI-17052 which modified https://github.com/xwiki/xwiki-platform/commit/f490e0b28e9f9aa755ef26c293f85452ac1a0db9#diff-df6b621d8b03f4a097acf7d488c8f1d0f0a564637113d346c58b0da1983b8476R1117-R1137 I'm not sure why there's the need to XML-escape the parameters passed to {{$services.notification.sources.getNotificationParameters($parameters)}}. They are needed to be escaped for the HTML part for sure but for the java part, I don't see the need. The problem is that it transforms the {{A&B}} value for {{spaces}} into: {{A&B}} which doesn't exist as a space... It would also break for any XML character that needs escaping and that it part of a space name... [~surli] would it work to write: {code} #set ($parameters = { "userId": "$services.model.serialize($xcontext.userReference, 'default')", "maxCount": "$xcontext.macro.params.count", "useUserPreferences": "$xcontext.macro.params.useUserPreferences", "displayOwnEvents": "$xcontext.macro.params.displayOwnEvents", "displayMinorEvents": "$xcontext.macro.params.displayMinorEvents", "displaySystemEvents": "$xcontext.macro.params.displaySystemEvents", "displayReadEvents": "$xcontext.macro.params.displayReadEvents", "wikis": "$xcontext.macro.params.wikis", "spaces": "$xcontext.macro.params.spaces", "pages": "$xcontext.macro.params.pages", "users": "$users", "currentWiki": "$services.wiki.currentWikiId", "tags": "$xcontext.macro.params.tags" }) #set ($dataParameters = []) #foreach($key in $parameters.keySet()) #set($discard = $dataParameters.add("data-$key=""$!escapetool.xml($parameters.get($key))""")) #end #set($notifParameters = $services.notification.sources.getNotificationParameters($parameters)) #set($notifs = $services.notification.notifiers.getNotifications($notifParameters, true)) {code} ?

	Vincent Massol on 04/Dec/25 17:15

	I think it's a regression from XWIKI-17052 which modified https://github.com/xwiki/xwiki-platform/commit/f490e0b28e9f9aa755ef26c293f85452ac1a0db9#diff-df6b621d8b03f4a097acf7d488c8f1d0f0a564637113d346c58b0da1983b8476R1117-R1137 I'm not sure why there's the need to XML-escape the parameters passed to {{$services.notification.sources.getNotificationParameters($parameters)}}. They are needed to be escaped for the HTML part for sure but for the java part, I don't see the need. The problem is that it transforms the {{A&B}} value for {{spaces}} into: {{A&B}} which doesn't exist as a space... It would also break for any XML character that needs escaping and that it part of a space name... [~surli] would it work to write: {code} #set ($parameters = { "userId": "$services.model.serialize($xcontext.userReference, 'default')", "maxCount": "$xcontext.macro.params.count", "useUserPreferences": "$xcontext.macro.params.useUserPreferences", "displayOwnEvents": "$xcontext.macro.params.displayOwnEvents", "displayMinorEvents": "$xcontext.macro.params.displayMinorEvents", "displaySystemEvents": "$xcontext.macro.params.displaySystemEvents", "displayReadEvents": "$xcontext.macro.params.displayReadEvents", "wikis": "$xcontext.macro.params.wikis", "spaces": "$xcontext.macro.params.spaces", "pages": "$xcontext.macro.params.pages", "users": "$users", "currentWiki": "$services.wiki.currentWikiId", "tags": "$xcontext.macro.params.tags" }) #set ($dataParameters = []) #foreach($key in $parameters.keySet()) #set($discard = $dataParameters.add("data-$key=""$!escapetool.xml($parameters.get($key))""")) #end #set($notifParameters = $services.notification.sources.getNotificationParameters($parameters)) #set($notifs = $services.notification.notifiers.getNotifications($notifParameters, true)) {code} vs what you had: {code} #set ($parameters = { "userId": "$services.model.serialize($xcontext.userReference, 'default')", "maxCount": "$xcontext.macro.params.count", "useUserPreferences": "$xcontext.macro.params.useUserPreferences", "displayOwnEvents": "$xcontext.macro.params.displayOwnEvents", "displayMinorEvents": "$xcontext.macro.params.displayMinorEvents", "displaySystemEvents": "$xcontext.macro.params.displaySystemEvents", "displayReadEvents": "$xcontext.macro.params.displayReadEvents", "wikis": "$xcontext.macro.params.wikis", "spaces": "$xcontext.macro.params.spaces", "pages": "$xcontext.macro.params.pages", "users": "$users", "currentWiki": "$services.wiki.currentWikiId", "tags": "$xcontext.macro.params.tags" }) #set ($dataParameters = []) #foreach($key in $parameters.keySet()) #set($discard = $dataParameters.add("data-$key=""$!escapetool.xml($parameters.get($key))""")) #end #set($notifParameters = $services.notification.sources.getNotificationParameters($parameters)) #set($notifs = $services.notification.notifiers.getNotifications($notifParameters, true)) {code} ?

	Vincent Massol on 04/Dec/25 17:15

	I think it's a regression from XWIKI-17052 which modified https://github.com/xwiki/xwiki-platform/commit/f490e0b28e9f9aa755ef26c293f85452ac1a0db9#diff-df6b621d8b03f4a097acf7d488c8f1d0f0a564637113d346c58b0da1983b8476R1117-R1137 I'm not sure why there's the need to XML-escape the parameters passed to {{$services.notification.sources.getNotificationParameters($parameters)}}. They are needed to be escaped for the HTML part for sure but for the java part, I don't see the need. The problem is that it transforms the {{A&B}} value for {{spaces}} into: {{A&B}} which doesn't exist as a space... It would also break for any XML character that needs escaping and that it part of a space name... [~surli] would it work to write: {code} #set ($parameters = { "userId": "$services.model.serialize($xcontext.userReference, 'default')", "maxCount": "$xcontext.macro.params.count", "useUserPreferences": "$xcontext.macro.params.useUserPreferences", "displayOwnEvents": "$xcontext.macro.params.displayOwnEvents", "displayMinorEvents": "$xcontext.macro.params.displayMinorEvents", "displaySystemEvents": "$xcontext.macro.params.displaySystemEvents", "displayReadEvents": "$xcontext.macro.params.displayReadEvents", "wikis": "$xcontext.macro.params.wikis", "spaces": "$xcontext.macro.params.spaces", "pages": "$xcontext.macro.params.pages", "users": "$users", "currentWiki": "$services.wiki.currentWikiId", "tags": "$xcontext.macro.params.tags" }) #set ($dataParameters = []) #foreach($key in $parameters.keySet()) #set($discard = $dataParameters.add("data-$key=""$!escapetool.xml($parameters.get($key))""")) #end #set($notifParameters = $services.notification.sources.getNotificationParameters($parameters)) #set($notifs = $services.notification.notifiers.getNotifications($notifParameters, true)) {code} vs what you had: {code} #set ($parameters = { "userId": "$ !escapetool.xml($ services.model.serialize($xcontext.userReference, 'default') ) ", "maxCount": "$ !escapetool.xml($ xcontext.macro.params.count ) ", "useUserPreferences": "$ !escapetool.xml($ xcontext.macro.params.useUserPreferences ) ", "displayOwnEvents": "$ !escapetool.xml($ xcontext.macro.params.displayOwnEvents ) ", "displayMinorEvents": "$ !escapetool.xml($ xcontext.macro.params.displayMinorEvents ) ", "displaySystemEvents": "$ !escapetool.xml($ xcontext.macro.params.displaySystemEvents ) ", "displayReadEvents": "$ !escapetool.xml($ xcontext.macro.params.displayReadEvents ) ", "wikis": "$ !escapetool.xml($ xcontext.macro.params.wikis ) ", "spaces": "$ !escapetool.xml($ xcontext.macro.params.spaces ) ", "pages": "$ !escapetool.xml($ xcontext.macro.params.pages ) ", "users": "$ !escapetool.xml($ users ) ", "currentWiki": "$ !escapetool.xml($ services.wiki.currentWikiId ) ", "tags": "$ !escapetool.xml($ xcontext.macro.params.tags ) " }) #set ($dataParameters = []) #foreach($key in $parameters.keySet()) #set($discard = $dataParameters.add("data-$key=""$ !escapetool.xml($ parameters.get($key) ) """)) #end #set($notifParameters = $services.notification.sources.getNotificationParameters($parameters)) #set($notifs = $services.notification.notifiers.getNotifications($notifParameters, true)) {code} ?

	Vincent Massol on 04/Dec/25 17:16

	I think it's a regression from XWIKI-17052 which modified https://github.com/xwiki/xwiki-platform/commit/f490e0b28e9f9aa755ef26c293f85452ac1a0db9#diff-df6b621d8b03f4a097acf7d488c8f1d0f0a564637113d346c58b0da1983b8476R1117-R1137 I'm not sure why there's the need to XML-escape the parameters passed to {{$services.notification.sources.getNotificationParameters($parameters)}}. They are needed to be escaped for the HTML part for sure but for the java part, I don't see the need. The problem is that it transforms the {{A&B}} value for {{spaces}} into: {{A&B}} which doesn't exist as a space... It would also break for any XML character that needs escaping and that it part of a space name... [~surli] would it work to write: {code} #set ($parameters = { "userId": "$services.model.serialize($xcontext.userReference, 'default')", "maxCount": "$xcontext.macro.params.count", "useUserPreferences": "$xcontext.macro.params.useUserPreferences", "displayOwnEvents": "$xcontext.macro.params.displayOwnEvents", "displayMinorEvents": "$xcontext.macro.params.displayMinorEvents", "displaySystemEvents": "$xcontext.macro.params.displaySystemEvents", "displayReadEvents": "$xcontext.macro.params.displayReadEvents", "wikis": "$xcontext.macro.params.wikis", "spaces": "$xcontext.macro.params.spaces", "pages": "$xcontext.macro.params.pages", "users": "$users", "currentWiki": "$services.wiki.currentWikiId", "tags": "$xcontext.macro.params.tags" }) #set ($dataParameters = []) #foreach($key in $parameters.keySet()) #set($discard = $dataParameters.add("data-$key=""$!escapetool.xml($parameters.get($key))""")) #end #set($notifParameters = $services.notification.sources.getNotificationParameters($parameters)) #set($notifs = $services.notification.notifiers.getNotifications($notifParameters, true)) {code} vs what you had: {code} #set ($parameters = { "userId": "$!escapetool.xml($services.model.serialize($xcontext.userReference, 'default'))", "maxCount": "$!escapetool.xml($xcontext.macro.params.count)", "useUserPreferences": "$!escapetool.xml($xcontext.macro.params.useUserPreferences)", "displayOwnEvents": "$!escapetool.xml($xcontext.macro.params.displayOwnEvents)", "displayMinorEvents": "$!escapetool.xml($xcontext.macro.params.displayMinorEvents)", "displaySystemEvents": "$!escapetool.xml($xcontext.macro.params.displaySystemEvents)", "displayReadEvents": "$!escapetool.xml($xcontext.macro.params.displayReadEvents)", "wikis": "$!escapetool.xml($xcontext.macro.params.wikis)", "spaces": "$!escapetool.xml($xcontext.macro.params.spaces)", "pages": "$!escapetool.xml($xcontext.macro.params.pages)", "users": "$!escapetool.xml($users)", "currentWiki": "$!escapetool.xml($services.wiki.currentWikiId)", "tags": "$!escapetool.xml($xcontext.macro.params.tags)" }) #set ($dataParameters = []) #foreach($key in $parameters.keySet()) #set($discard = $dataParameters.add("data-$key=""$parameters.get($key)""")) #end #set($notifParameters = $services.notification.sources.getNotificationParameters($parameters)) #set($notifs = $services.notification.notifiers.getNotifications($notifParameters, true)) {code} (in short I'm not escaping for the java call but escaping for the HTML display) ?

	Vincent Massol on 04/Dec/25 17:18

	I think the escaping is causing a lot more issues than this one reported. For example if the user name contains one of `", ', <, >, &` there'll be a similar issue.

This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)

If image attachments aren't displayed, see this article.