This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 6ee8159664 Fixed: Escape the backslash and the braces in the macro
strings of the menu, tree and form renderers (OFBIZ-13649)
6ee8159664 is described below
commit 6ee8159664748bac4fa593ab11f4750d42db52bf
Author: Mridul Pathak <[email protected]>
AuthorDate: Tue Oct 6 19:32:44 2026 +0530
Fixed: Escape the backslash and the braces in the macro strings of the
menu, tree and form renderers (OFBIZ-13649)
The macro menu, tree and form renderers escaped only the double quote of
the values they put inside the string literals of the macro calls they build,
so a value containing a backslash or an interpolation such as ${...} was
interpreted by FreeMarker instead of being rendered literally. The macro screen
renderer already escaped the backslash, the double quote and the opening brace.
- Add MacroCommonRenderer.escapeFtlString, which escapes the backslash, the
double quote and the opening brace of a value placed in a double-quoted
FreeMarker string literal.
- Use it in MacroMenuRenderer.executeMacro, in the imgStr of
MacroTreeRenderer and in the three places of MacroFormRenderer that used
encodeDoubleQuotes (which is removed), and in place of the inline escaping of
MacroScreenRenderer.executeMacro.
- The values that these renderers append without any escaping are not
changed here.
---
.../ofbiz/widget/renderer/macro/MacroCommonRenderer.java | 11 +++++++++++
.../apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java | 10 +++-------
.../apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java | 2 +-
.../ofbiz/widget/renderer/macro/MacroScreenRenderer.java | 2 +-
.../apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java | 2 +-
.../ofbiz/widget/renderer/macro/MacroFormRendererTest.java | 2 +-
6 files changed, 18 insertions(+), 11 deletions(-)
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
index 0fc9cd7db6..9a49b40581 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroCommonRenderer.java
@@ -38,6 +38,17 @@ import org.apache.ofbiz.widget.model.ModelForm;
public class MacroCommonRenderer {
+ /**
+ * Escape a value so that it is rendered literally when it is placed
inside a double-quoted FreeMarker
+ * string literal of a macro call: the backslash and the double quote are
escaped, and so is the opening
+ * brace, so that neither <code>${...}</code> nor <code>#{...}</code> is
interpolated.
+ * @param value the value to escape, may be null
+ * @return the escaped value, or an empty string if the value is null
+ */
+ public static String escapeFtlString(String value) {
+ return value == null ? "" : value.replace("\\", "\\\\").replace("\"",
"\\\"").replace("{", "\\{");
+ }
+
/**
* Create an ajaxXxxx JavaScript CSV string from a list of UpdateArea
objects. See
* <code>OfbizUtil.js</code>.
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
index 9f4b3ca576..457dd7e5c7 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRenderer.java
@@ -131,10 +131,6 @@ public final class MacroFormRenderer implements
FormStringRenderer {
: new RenderableFtlFormElementsBuilder(this.visualTheme, rh,
request, response, staticContentUrlProvider);
}
- private static String encodeDoubleQuotes(String htmlString) {
- return htmlString.replace("\"", "\\\"");
- }
-
public boolean getRenderPagination() {
return this.renderPagination;
}
@@ -649,7 +645,7 @@ public final class MacroFormRenderer implements
FormStringRenderer {
sr.append(" name=\"");
sr.append(modelFormField.getModelForm().getName());
sr.append("\" title=\"");
- sr.append(encodeDoubleQuotes(title));
+ sr.append(MacroCommonRenderer.escapeFtlString(title));
sr.append("\" />");
executeMacro(writer, sr.toString());
} else if (modelFormField.isSortField()) {
@@ -689,7 +685,7 @@ public final class MacroFormRenderer implements
FormStringRenderer {
String helpText =
UtilHelpText.getEntityFieldDescription(entityName, fieldName, delegator,
locale);
sr.append("\" fieldHelpText=\"");
- sr.append(encodeDoubleQuotes(helpText));
+ sr.append(MacroCommonRenderer.escapeFtlString(helpText));
}
sr.append("\" title=\"");
sr.append(sb.toString());
@@ -2377,7 +2373,7 @@ public final class MacroFormRenderer implements
FormStringRenderer {
sr.append("\" alternate=\"");
sr.append(alt);
sr.append("\" targetParameters=\"");
- sr.append(encodeDoubleQuotes(targetParameters.toString()));
+
sr.append(MacroCommonRenderer.escapeFtlString(targetParameters.toString()));
sr.append("\" linkUrl=\"");
sr.append(linkUrl.toString());
sr.append("\" targetWindow=\"");
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
index c989c32819..a6b1d2de7b 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroMenuRenderer.java
@@ -124,7 +124,7 @@ public class MacroMenuRenderer implements
MenuStringRenderer {
Object value = parameter.getValue();
if (value instanceof String) {
sb.append('"');
- sb.append(((String) value).replace("\"", "\\\""));
+ sb.append(MacroCommonRenderer.escapeFtlString((String)
value));
sb.append('"');
} else {
sb.append(value);
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
index 98a93862b4..3574d4ee3a 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroScreenRenderer.java
@@ -125,7 +125,7 @@ public class MacroScreenRenderer implements
ScreenStringRenderer {
Object value = parameter.getValue();
if (value instanceof String) {
sb.append('"');
- sb.append(((String) value).replace("\\",
"\\\\").replace("\"", "\\\"").replace("{", "\\{"));
+ sb.append(MacroCommonRenderer.escapeFtlString((String)
value));
sb.append('"');
} else {
sb.append(value);
diff --git
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
index 0a6c002000..3ef9584126 100644
---
a/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
+++
b/framework/widget/src/main/java/org/apache/ofbiz/widget/renderer/macro/MacroTreeRenderer.java
@@ -292,7 +292,7 @@ public class MacroTreeRenderer implements
TreeStringRenderer {
sr.append("\" linkText=\"");
sr.append(linkText);
sr.append("\" imgStr=\"");
- sr.append(imgStr.replace("\"", "\\\""));
+ sr.append(MacroCommonRenderer.escapeFtlString(imgStr));
sr.append("\" />");
executeMacro(sr.toString().replace("|", "%7C")); // Fix for OFBIZ-9191
}
diff --git
a/framework/widget/src/test/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRendererTest.java
b/framework/widget/src/test/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRendererTest.java
index 6c767af158..b749cecc99 100644
---
a/framework/widget/src/test/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRendererTest.java
+++
b/framework/widget/src/test/java/org/apache/ofbiz/widget/renderer/macro/MacroFormRendererTest.java
@@ -962,7 +962,7 @@ public class MacroFormRendererTest {
.put("description", description)
.put("linkUrl", "Encoded%20Target")
.put("id", id)
- .put("targetParameters",
"{\\\"k1\\\":\\\"v1\\\",\\\"k2\\\":\\\"v2\\\",\\\"presentation\\\":\\\"layer\\\"}")
+ .put("targetParameters",
"\\{\\\"k1\\\":\\\"v1\\\",\\\"k2\\\":\\\"v2\\\",\\\"presentation\\\":\\\"layer\\\"}")
.put("width", width)
.put("confirmation", confirmation)
.put("targetWindow", targetWindow)
