(ofbiz-framework) branch trunk updated: Improved: escape link parameter values in MacroScreenRenderer.renderLink (#1711)

[ashish]

This is an automated email from the ASF dual-hosted git repository.

ashishvijaywargiya pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/trunk by this push:
     new 9d096f9af8 Improved: escape link parameter values in 
MacroScreenRenderer.renderLink (#1711)
9d096f9af8 is described below

commit 9d096f9af85db998f028643a0b169fa6b84349e4
Author: Krishna Uprit <krishna.collage.offic...@gmail.com>
AuthorDate: Mon Aug 24 12:09:56 2026 +0530

    Improved: escape link parameter values in MacroScreenRenderer.renderLink 
(#1711)
    
    - Parameter names and values were appended to the generated FTL macro
    call without escaping. Added escapeFtlSingleQuoted() to escape these
    values before they are embedded in the macro string, consistent with
    escaping already used elsewhere in this class.
    
    - Corrected existing escaping in the other executeMacro overload, which
    escaped a lone dollar sign with a backslash - not a valid FTL string
    escape, and one that failed to parse for any value containing a plain
    "$". Escaping the following brace instead is sufficient and valid
    syntax.
    
    Thank you Krishna Uprit for your contribution.
    
    Co-authored-by: Krishnauprit18 <krishnaupri...@users.noreply.github.com>
---
 .../ofbiz/widget/renderer/macro/MacroScreenRenderer.java       | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
index 4419cdf0b6..4bc9db855b 100644
--- 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
+++ 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
@@ -126,7 +126,7 @@ public class MacroScreenRenderer implements 
ScreenStringRenderer {
                 Object value = parameter.getValue();
                 if (value instanceof String) {
                     sb.append('"');
-                    sb.append(((String) value).replace("\\", 
"\\\\").replace("\"", "\\\"").replace("$", "\\$"));
+                    sb.append(((String) value).replace("\\", 
"\\\\").replace("\"", "\\\"").replace("{", "\\{"));
                     sb.append('"');
                 } else {
                     sb.append(value);
@@ -137,6 +137,10 @@ public class MacroScreenRenderer implements 
ScreenStringRenderer {
         executeMacro(writer, sb.toString());
     }
 
+    private static String escapeFtlSingleQuoted(String value) {
+        return value == null ? "" : value.replace("\\", "\\\\").replace("'", 
"\\'").replace("{", "\\{");
+    }
+
     private Environment getEnvironment(Appendable writer) throws 
TemplateException, IOException {
         Environment environment = environments.get(writer);
         if (environment == null) {
@@ -298,10 +302,10 @@ public class MacroScreenRenderer implements 
ScreenStringRenderer {
                     parameters.append(",");
                 }
                 parameters.append("{'name':'");
-                parameters.append(parameter.getKey());
+                parameters.append(escapeFtlSingleQuoted(parameter.getKey()));
                 parameters.append("'");
                 parameters.append(",'value':'");
-                parameters.append(parameter.getValue());
+                parameters.append(escapeFtlSingleQuoted(parameter.getValue()));
                 parameters.append("'}");
             }
             parameters.append("]");