(ofbiz-framework) branch release24.09 updated: Improved: escape link parameter values in MacroScreenRenderer.renderLink (#1711) (#1715)

[ashish]

This is an automated email from the ASF dual-hosted git repository.

ashishvijaywargiya pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release24.09 by this push:
     new 37f19aadc9 Improved: escape link parameter values in 
MacroScreenRenderer.renderLink (#1711) (#1715)
37f19aadc9 is described below

commit 37f19aadc9c08a689b10dcc2657677c629d1d590
Author: Ashish Vijaywargiya <ash...@apache.org>
AuthorDate: Mon Aug 24 15:38:55 2026 +0530

    Improved: escape link parameter values in MacroScreenRenderer.renderLink 
(#1711) (#1715)
    
    - Parameter names and values were appended to the generated FTL macro
    call without escaping. Added escapeFtlSingleQuoted() to escape these
    values before they are embedded in the macro string, consistent with
    escaping already used elsewhere in this class.
    
    - Corrected existing escaping in the other executeMacro overload, which
    escaped a lone dollar sign with a backslash - not a valid FTL string
    escape, and one that failed to parse for any value containing a plain
    "$". Escaping the following brace instead is sufficient and valid
    syntax.
    
    Cherry-picked from trunk commit
    9d096f9af85db998f028643a0b169fa6b84349e4.
    
    Thank you Krishna Uprit for your contribution.
    
    Co-authored-by: Krishna Uprit <krishna.collage.offic...@gmail.com>
    Co-authored-by: Krishnauprit18 <krishnaupri...@users.noreply.github.com>
---
 .../ofbiz/widget/renderer/macro/MacroScreenRenderer.java       | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
index 15d0d0ee44..98a93862b4 100644
--- 
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
+++ 
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
@@ -125,7 +125,7 @@ public class MacroScreenRenderer implements 
ScreenStringRenderer {
                 Object value = parameter.getValue();
                 if (value instanceof String) {
                     sb.append('"');
-                    sb.append(((String) value).replace("\\", 
"\\\\").replace("\"", "\\\"").replace("$", "\\$"));
+                    sb.append(((String) value).replace("\\", 
"\\\\").replace("\"", "\\\"").replace("{", "\\{"));
                     sb.append('"');
                 } else {
                     sb.append(value);
@@ -136,6 +136,10 @@ public class MacroScreenRenderer implements 
ScreenStringRenderer {
         executeMacro(writer, sb.toString());
     }
 
+    private static String escapeFtlSingleQuoted(String value) {
+        return value == null ? "" : value.replace("\\", "\\\\").replace("'", 
"\\'").replace("{", "\\{");
+    }
+
     private Environment getEnvironment(Appendable writer) throws 
TemplateException, IOException {
         Environment environment = environments.get(writer);
         if (environment == null) {
@@ -298,10 +302,10 @@ public class MacroScreenRenderer implements 
ScreenStringRenderer {
                     parameters.append(",");
                 }
                 parameters.append("{'name':'");
-                parameters.append(parameter.getKey());
+                parameters.append(escapeFtlSingleQuoted(parameter.getKey()));
                 parameters.append("'");
                 parameters.append(",'value':'");
-                parameters.append(parameter.getValue());
+                parameters.append(escapeFtlSingleQuoted(parameter.getValue()));
                 parameters.append("'}");
             }
             parameters.append("]");