This issue has been created
There is 1 update.
 
 
XWiki Commons / cid:jira-generated-image-avatar-d5dcbe56-186e-4128-8c47-551b9c5d6f8b XCOMMONS-3371 Open

$jsontool and $escapetool should escape { to increase compatibility with XWiki syntax rendering

 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-7c635ab3-3f4a-474d-84e4-ea53f7df1a0a Michael Hamann created this issue on 10/Jul/25 15:45
 
Summary: $jsontool and $escapetool should escape { to increase compatibility with XWiki syntax rendering
Issue Type: cid:jira-generated-image-avatar-d5dcbe56-186e-4128-8c47-551b9c5d6f8b Bug
Affects Versions: 16.10.0
Assignee: Unassigned
Components: Velocity
Created: 10/Jul/25 15:45
Priority: cid:jira-generated-image-static-major-7ba2630e-01c0-4e91-961a-4aec1da7bdaa Major
Reporter: Michael Hamann
Description:

The output of $jsontool and $escapetool.javascript is frequently used in HTML macros. To prevent that their output could interfere with the closing of the surrounding HTML macro, both should escape {. This also prevents accidental escaping of such output with HTML escaping that would alter the meaning of the content.

Steps to reproduce:

Put one of the following two wiki syntaxes in a document:

{{velocity}}
{{html clean="false"}}
$jsontool.serialize('{{html}}')
{{/html}}
{{/velocity}}
{{velocity}}
{{html clean="false"}}
$escapetool.javascript('{{html}}')
{{/html}}
{{/velocity}}

Expected result:

The text

{{html}}

 is displayed (in quotes for the json tool).

Actual result:

For the first version

"{{html}}" {{/html}} 

is displayed, the second version produces

{{html}} {{/html}}

This shows that due to the extra opening HTML macro syntax, the parser considers the closing HTML macro syntax as content, leading to the unwanted output. This is in particular a problem when the printed text contains user-controlled strings. Both tools already escape "/" so their output cannot close the HTML macro.

 
 

1 update

 
cid:jira-generated-image-avatar-7c635ab3-3f4a-474d-84e4-ea53f7df1a0a Changes by Michael Hamann on 10/Jul/25 15:45
 
Assignee: Michael Hamann