I'm adding a first list of such html macro uses, obtained with the script below generated with the help of Claude Code, we should check page per page whether the wrapped content or script cannot contain user-entered content.
#!/usr/bin/env bash
# List {{html}} macro calls in tracked files that don't set clean="false".
# Run from the root of an xwiki-platform checkout. Optional argument: output directory (default: .).
# Limits: a tag whose parameters continue onto the next line is missed; untracked files are ignored.
set -euo pipefail
out=${1:-.}
# 1. Every html macro opening tag written on one line: {{html}}, {{html/}}, {{html wiki="true"}}...
# -o prints only the tag, -n adds the line number, -I skips binary files.
git ls-files -z | xargs -0 grep -nIoE '\{\{html(\s[^}]*)?/?\}\}' > "$out/html.txt" || true
# 2. Keep the tags without clean=false, in any quoting: clean="false", clean='false',
# clean=false, and clean=\"false\" inside Java strings.
grep -vE "clean=\\\\?[\"']?false" "$out/html.txt" > "$out/noclean.txt" || true
# 3. Split into tests, Help examples and production code.
test_re='/src/test/|-test/'
help_re='help-ui/.*/(XWiki/XWikiSyntax|Help/)'
grep -E "$test_re""$out/noclean.txt" > "$out/tests.txt" || true
grep -vE "$test_re""$out/noclean.txt" | grep -E "$help_re" > "$out/help.txt" || true
grep -vE "$test_re""$out/noclean.txt" | grep -vE "$help_re" > "$out/prod.txt" || true
wc -l "$out"/{html,noclean,tests,help,prod}.txt
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.
