| Steps to reproduce:
- Open the WYSIWYG editor on any page
- Insert an information box
- Inside the box, insert an image
- Set /info as alternative text of the image
- Save the page.
Expected result: The image is displayed inside an information box with the selected alt text. Actual result: No image is displayed, instead
is displayed: This is because the closing info macro syntax isn't escaped inside the attribute of the image and then the parser treats this as the closing tag of the macro. The same issue exists in inline and block-level parameter syntaxes, link parameters, link and image references both with full syntax and freestanding and the ID event (which has no escaping at all, but also cannot be triggered through WYSIWYG). |