This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 83d8ff9b36 Fixed: Escape the backslash and the braces in the macro
strings of the menu, tree and form renderers (OFBIZ-13649)
83d8ff9b36 is described below
commit 83d8ff9b36194ca9a8f9be9c8ea7e4cd9dcb9eec
Author: Mridul Pathak <[email protected]>
AuthorDate: Tue Oct 6 19:32:44 2026 +0530
Fixed: Escape the backslash and the braces in the macro strings of the
menu, tree and form renderers (OFBIZ-13649)
The macro menu, tree and form renderers escaped only the double quote of
the values they put inside the string literals of the macro calls they build,
so a value containing a backslash or an interpolation such as ${...} was
interpreted by FreeMarker instead of being rendered literally. The macro screen
renderer already escaped the backslash, the double quote and the opening brace.
- Add MacroCommonRenderer.escapeFtlString, which escapes the backslash, the
double quote and the opening brace of a value placed in a double-quoted
FreeMarker string literal.
- Use it in MacroMenuRenderer.executeMacro, in the imgStr of
MacroTreeRenderer and in the three places of MacroFormRenderer that used
encodeDoubleQuotes (which is removed), and in place of the inline escaping of
MacroScreenRenderer.executeMacro.
- The values that these renderers append without any escaping are not
changed here.
---
.../ofbiz/widget/renderer/macro/MacroCommonRenderer.java | 11 +++++++++++
.../apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java | 10 +++-------
.../apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java | 2 +-
.../ofbiz/widget/renderer/macro/MacroScreenRenderer.java | 2 +-
.../apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java | 2 +-
.../ofbiz/widget/renderer/macro/MacroFormRendererTest.java | 2 +-
6 files changed, 18 insertions(+), 11 deletions(-)
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
index 8be5547151..060fcb1d6a 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
@@ -38,6 +38,17 @@ import org.apache.ofbiz.widget.model.ModelForm;
public class MacroCommonRenderer {
+ /**
+ * Escape a value so that it is rendered literally when it is placed
inside a double-quoted FreeMarker
+ * string literal of a macro call: the backslash and the double quote are
escaped, and so is the opening
+ * brace, so that neither <code>${...}</code> nor <code>#{...}</code> is
interpolated.
+ * @param value the value to escape, may be null
+ * @return the escaped value, or an empty string if the value is null
+ */
+ public static String escapeFtlString(String value) {
+ return value == null ? "" : value.replace("\\", "\\\\").replace("\"",
"\\\"").replace("{", "\\{");
+ }
+
/**
* Create an ajaxXxxx JavaScript CSV string from a list of UpdateArea
objects. See
* <code>OfbizUtil.js</code>.
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
index 87994dd20b..cc28442ca6 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
@@ -131,10 +131,6 @@ public final class MacroFormRenderer implements
FormStringRenderer {
: new RenderableFtlFormElementsBuilder(this.visualTheme, rh,
request, response, staticContentUrlProvider);
}
- private static String encodeDoubleQuotes(String htmlString) {
- return htmlString.replace("\"", "\\\"");
- }
-
public boolean getRenderPagination() {
return this.renderPagination;
}
@@ -653,7 +649,7 @@ public final class MacroFormRenderer implements
FormStringRenderer {
sr.append(" name=\"");
sr.append(modelFormField.getModelForm().getName());
sr.append("\" title=\"");
- sr.append(encodeDoubleQuotes(title));
+ sr.append(MacroCommonRenderer.escapeFtlString(title));
sr.append("\" />");
executeMacro(writer, sr.toString());
} else if (modelFormField.isSortField()) {
@@ -693,7 +689,7 @@ public final class MacroFormRenderer implements
FormStringRenderer {
String helpText =
UtilHelpText.getEntityFieldDescription(entityName, fieldName, delegator,
locale);
sr.append("\" fieldHelpText=\"");
- sr.append(encodeDoubleQuotes(helpText));
+ sr.append(MacroCommonRenderer.escapeFtlString(helpText));
}
sr.append("\" title=\"");
sr.append(sb.toString());
@@ -2389,7 +2385,7 @@ public final class MacroFormRenderer implements
FormStringRenderer {
sr.append("\" alternate=\"");
sr.append(alt);
sr.append("\" targetParameters=\"");
- sr.append(encodeDoubleQuotes(targetParameters.toString()));
+
sr.append(MacroCommonRenderer.escapeFtlString(targetParameters.toString()));
sr.append("\" linkUrl=\"");
sr.append(linkUrl.toString());
sr.append("\" targetWindow=\"");
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
index 13148312f6..5aaf198709 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
@@ -124,7 +124,7 @@ public class MacroMenuRenderer implements
MenuStringRenderer {
Object value = parameter.getValue();
if (value instanceof String) {
sb.append('"');
- sb.append(((String) value).replace("\"", "\\\""));
+ sb.append(MacroCommonRenderer.escapeFtlString((String)
value));
sb.append('"');
} else {
sb.append(value);
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
index 4bc9db855b..3a7cf63566 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
@@ -126,7 +126,7 @@ public class MacroScreenRenderer implements
ScreenStringRenderer {
Object value = parameter.getValue();
if (value instanceof String) {
sb.append('"');
- sb.append(((String) value).replace("\\",
"\\\\").replace("\"", "\\\"").replace("{", "\\{"));
+ sb.append(MacroCommonRenderer.escapeFtlString((String)
value));
sb.append('"');
} else {
sb.append(value);
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
index 43d4815a8f..4dd3bb23a3 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
@@ -292,7 +292,7 @@ public class MacroTreeRenderer implements
TreeStringRenderer {
sr.append("\" linkText=\"");
sr.append(linkText);
sr.append("\" imgStr=\"");
- sr.append(imgStr.replace("\"", "\\\""));
+ sr.append(MacroCommonRenderer.escapeFtlString(imgStr));
sr.append("\" />");
executeMacro(sr.toString().replace("|", "%7C")); // Fix for OFBIZ-9191
}
diff --git
a/framework/widget/src/test/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRendererTest.java
b/framework/widget/src/test/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRendererTest.java
index 5d9b53904c..40097f106c 100644
---
a/framework/widget/src/test/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRendererTest.java
+++
b/framework/widget/src/test/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRendererTest.java
@@ -797,7 +797,7 @@ public final class MacroFormRendererTest {
.put("description", description)
.put("linkUrl", "Encoded%20Target")
.put("id", id)
- .put("targetParameters",
"{\\\"k1\\\":\\\"v1\\\",\\\"k2\\\":\\\"v2\\\",\\\"presentation\\\":\\\"layer\\\"}")
+ .put("targetParameters",
"\\{\\\"k1\\\":\\\"v1\\\",\\\"k2\\\":\\\"v2\\\",\\\"presentation\\\":\\\"layer\\\"}")
.put("width", width)
.put("confirmation", confirmation)
.put("targetWindow", targetWindow)
