XRENDERING-815: XWiki syntax renderer doesn't escape closing macro syntax in various attributes

[michitux]

Jira URL

https://jira.xwiki.org/browse/XRENDERING-815

Changes

Description

• Escape the "{" runs of every value that the renderer serializes as-is:
  • (%...%) parameter values
  • link and image references, their parameters, and the xwiki/2.1 queryString and anchor reference parameters
  • the id macro name, which had no escaping at all and could also be broken by a quote in the name
• Introduce XWikiSyntaxEscapeHandler#escapeCurlyBrackets as escaping helper that correctly escapes every character of a run of "{" instead of only the pairs: the previous two-pass "{{{"-then-"{{" replacement corrupted runs of four "{" and left a literal "{{" behind for runs of five, so it could still break out of a macro.
• For free-standing references which cannot be escaped at all, fall back to the full [[...]] syntax when printing the reference free-standing would put a "{{" into the output, as that could close the macro the reference is serialized in. This is only about the macro syntax: the image and attachment tokens of the parser accept a "{{" and parse such a reference back unchanged, and where they don't - the URI token accepts no "{" at all - the reference is truncated just like by every other character that token rejects (a "}" or a "," for instance). That pre-existing limitation of free-standing references is not addressed here.
• Correctly escape the reference of links that were initially freestanding when forced into the full syntax.
• Expect [[{{macro}}]] in links6.test: the escaped form parses back to the very same reference while the previous output could badly interfere with outer macro syntax.

Clarifications

• This fixes more than the original issue description, the general aim of this is to improve the correctness of the XWiki syntax renderer to make parse-render roundtrips correct.
• Both bug investigation and implementation were mostly done by Claude Opus 5 (1M context) noreply@anthropic.com with some guidance and review from my side.

Screenshots & Video

No UI changes.

Executed Tests

Whole xwiki-rendering with quality profile.

Expected merging strategy

• Prefers squash: Yes
• Backport on branches:
  • stable-18.4.x
  • stable-17.10.x
  • stable-16.10.x

[Copilot]

🔵 Needs a closer look

XWikiSyntaxChainingRenderer can still emit an IdBlock incorrectly after a preceding {; it should use the inline-macro printing path.

Pull request overview

Fixes XWiki 2.0/2.1 renderer round-trip issues caused by unescaped {{ sequences in macro content.

Changes:

• Adds robust curly-bracket escaping for parameters, references, IDs, and link metadata.
• Uses full link syntax for unsafe free-standing references.
• Adds regression and round-trip tests.

File summaries

File	Description
xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki21/src/test/java/org/xwiki/rendering/internal/renderer/xwiki21/XWikiSyntaxMacroContentRoundTripTest.java	Adds XWiki 2.1 macro-content round-trip coverage.
xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki21/src/main/java/org/xwiki/rendering/internal/renderer/xwiki21/reference/XWikiSyntaxResourceRenderer.java	Escapes XWiki 2.1 references, query strings, anchors, and link parameters.
xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/test/java/org/xwiki/rendering/internal/renderer/xwiki20/XWikiSyntaxMacroContentRoundTripTest.java	Adds XWiki 2.0 macro-content round-trip coverage.
xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/test/java/org/xwiki/rendering/internal/renderer/xwiki20/XWikiSyntaxFreeStandingReferenceTest.java	Tests full-syntax fallback for unsafe references.
xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/main/java/org/xwiki/rendering/internal/renderer/xwiki20/XWikiSyntaxEscapeHandler.java	Escapes complete curly-bracket runs.
xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/main/java/org/xwiki/rendering/internal/renderer/xwiki20/XWikiSyntaxChainingRenderer.java	Escapes parameters and ID macro values.
xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/main/java/org/xwiki/rendering/internal/renderer/xwiki20/reference/XWikiSyntaxResourceRenderer.java	Escapes references and selects safe link syntax.
xwiki-rendering-integration-tests/src/test/resources/wiki/link/links6.test	Updates escaped-reference expectations.
xwiki-rendering-integration-tests/src/test/resources/simple/macros/macro39.test	Adds escaped link-reference coverage.
xwiki-rendering-integration-tests/src/test/resources/simple/macros/macro38.test	Adds escaped macro-parameter coverage.

Review details

Suppressed comments (1)

xwiki-rendering-syntaxes/xwiki-rendering-syntax-xwiki20/src/main/java/org/xwiki/rendering/internal/renderer/xwiki20/XWikiSyntaxChainingRenderer.java:532

• This emits an inline macro through print(...), so the escape printer does not apply its printInlineMacro() guard for a preceding delayed {. An IdBlock immediately following text { can therefore render as {{{id..., which the parser treats as verbatim syntax instead of a literal brace followed by the id macro. Use the inline-macro printing path here, as onMacro() does, so the preceding brace is escaped.

        print(getMacroPrinter().renderMacro("id", Map.of("name", name), null, true));

• Files reviewed: 10/10 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

💔 All backports failed

Status	Branch	Result
❌	stable-16.10.x	Backport failed because of merge conflicts
❌	stable-17.10.x	Backport failed because of merge conflicts
❌	stable-18.4.x	Backport failed because of merge conflicts

Manual backport

To create the backport manually run:

backport --pr 433

Questions ?

Please refer to the Backport tool documentation and see the Github Action logs for details