Branch: refs/heads/stable-18.4.x Home: https://github.com/xwiki/xwiki-rendering Commit: 3ba96fdff167d093f80c26da996c9a9faa9856cf https://github.com/xwiki/xwiki-rendering/commit/3ba96fdff167d093f80c26da996c... Author: Michael Hamann <[email protected]> Date: 2026-09-15 (Tue, 15 Sep 2026) Changed paths: A xwiki-rendering-integration-tests/src/test/resources/simple/macros/macro38.test A xwiki-rendering-integration-tests/src/test/resources/simple/macros/macro39.test M xwiki-rendering-integration-tests/src/test/resources/wiki/link/links6.test M xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/main/java/org/xwiki/rendering/internal/renderer/xwiki20/XWikiSyntaxChainingRenderer.java M xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/main/java/org/xwiki/rendering/internal/renderer/xwiki20/XWikiSyntaxEscapeHandler.java M xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/main/java/org/xwiki/rendering/internal/renderer/xwiki20/reference/XWikiSyntaxResourceRenderer.java M xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/test/java/org/xwiki/rendering/internal/renderer/xwiki20/XWikiSyntaxBlockRendererTest.java A xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/test/java/org/xwiki/rendering/internal/renderer/xwiki20/XWikiSyntaxFreeStandingReferenceTest.java A xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/test/java/org/xwiki/rendering/internal/renderer/xwiki20/XWikiSyntaxMacroContentRoundTripTest.java M xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki21/src/main/java/org/xwiki/rendering/internal/renderer/xwiki21/reference/XWikiSyntaxResourceRenderer.java A xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki21/src/test/java/org/xwiki/rendering/internal/renderer/xwiki21/XWikiSyntaxMacroContentRoundTripTest.java Log Message: ----------- XRENDERING-815: XWiki syntax renderer doesn't escape closing macro syntax in various attributes (#433) * Escape the "{" runs of every value that the renderer serializes as-is: * (%...%) parameter values * link and image references, their parameters, and the xwiki/2.1 queryString and anchor reference parameters * the id macro name, which had no escaping at all and could also be broken by a quote in the name * Introduce XWikiSyntaxEscapeHandler#escapeCurlyBrackets as escaping helper that correctly escapes every character of a run of "{" instead of only the pairs: the previous two-pass "{{{"-then-"{{" replacement corrupted runs of four "{" and left a literal "{{" behind for runs of five, so it could still break out of a macro. * For free-standing references which cannot be escaped at all, fall back to the full [[...]] syntax when printing the reference free-standing would put a "{{" into the output, as that could close the macro the reference is serialized in. This is only about the macro syntax: the image and attachment tokens of the parser accept a "{{" and parse such a reference back unchanged, and where they don't - the URI token accepts no "{" at all - the reference is truncated just like by every other character that token rejects (a "}" or a "," for instance). That pre-existing limitation of free-standing references is not addressed here. * Correctly escape the reference of links that were initially freestanding when forced into the full syntax. * Expect [[~{~{macro}}]] in links6.test: the escaped form parses back to the very same reference while the previous output could badly interfere with outer macro syntax. * Print the id macro through the inline macro printing of the printer so that a "{" printed just before it is escaped: otherwise the output started with "{{{" and was parsed back as a verbatim block. * Keep the bookkeeping of the regular printing - marking the first element as rendered and closing pending empty formatting parameters - by extracting it into printInlineMacro() instead of delegating to onMacro(), whose inline branch skips both and would thus glue a following paragraph to a standalone id macro. * Replace deprecated methods in the changed code by their non-deprecated equivalents - the escape character "~" is already passed in the constructor. Co-authored-by: Claude Opus 5 (1M context) <[email protected]> (cherry picked from commit 3352bcffe725cd3813b9240a6d347279587966f7) To unsubscribe from these emails, change your notification settings at https://github.com/xwiki/xwiki-rendering/settings/notifications