This issue has been created
There is 1 update.
 
 
XWiki Rendering / cid:jira-generated-image-avatar-92dba6cc-7239-46e0-a800-46112ea5b452 XRENDERING-815 Open

XWiki syntax renderer doesn't escape closing macro syntax in various attributes

 
View issue   ยท   Add comment
 

Issue created

 
cid:jira-generated-image-avatar-b88f421f-ca40-414b-ac23-92255951e980 Michael Hamann created this issue on 09/Sep/26 09:56
 
Summary: XWiki syntax renderer doesn't escape closing macro syntax in various attributes
Issue Type: cid:jira-generated-image-avatar-92dba6cc-7239-46e0-a800-46112ea5b452 Bug
Affects Versions: 16.10.0
Assignee: Unassigned
Attachments: image-2026-09-08-16-55-36-680.png
Components: Syntax - xwiki/2.0, Syntax - xwiki/2.1
Created: 09/Sep/26 09:56
Priority: cid:jira-generated-image-static-major-d1e1a8ea-fee7-416d-b9fb-67461b5abc85 Major
Reporter: Michael Hamann
Description:

Steps to reproduce:

  1. Open the WYSIWYG editor on any page
  2. Insert an information box
  3. Inside the box, insert an image
  4. Set /info as alternative text of the image
  5. Save the page.

Expected result:

The image is displayed inside an information box with the selected alt text.

Actual result:

No image is displayed, instead

"]]
{{/info}}

is displayed:

_thumb_45376.png

This is because the closing info macro syntax isn't escaped inside the attribute of the image and then the parser treats this as the closing tag of the macro. The same issue exists in inline and block-level parameter syntaxes, link parameters, link and image references both with full syntax and freestanding and the ID event (which has no escaping at all, but also cannot be triggered through WYSIWYG).

 
 

1 update

 
cid:jira-generated-image-avatar-b88f421f-ca40-414b-ac23-92255951e980 Changes by Michael Hamann on 09/Sep/26 09:56
 
Assignee: Michael Hamann