XWIKI-21626: Improve escaping during conflict resolution

xwiki · Mar 21, 2024 · 821d43e · 821d43e
1 parent d9e3fad
commit 821d43e
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 7 deletions.
diff --git a/...platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/EditIT.java b/...platform-flamingo-skin-test-docker/src/test/it/org/xwiki/flamingo/test/docker/EditIT.java
@@ -677,7 +677,7 @@ public void editWithConflict(TestUtils setup, TestReference testReference)
 
         wikiEditPageTab1.setContent(
               "First line."
-            + "\nSecond line."
+            + "\n<script>alert('Second line.')</script>"
             + "\nLine N°4"
             + "\nFifth line."
             + "\n6th line."
@@ -690,9 +690,9 @@ public void editWithConflict(TestUtils setup, TestReference testReference)
         assertEquals(EditConflictModal.ConflictChoice.MERGE, editConflictModal.getCurrentChoice());
         assertEquals(Arrays.asList("@@ -1,6 +1,6 @@",
             " First line.",
-            "-<del>L</del>ine<del> N°2</del>",
+            "-<del>L</del>i<del>n</del>e <del>N°2</del>",
             "-<del>Th</del>i<del>rd li</del>ne<del>.</del>",
-            "+<ins>Second l</ins>ine<ins>.</ins>",
+            "+<ins>&lt;scr</ins>i<ins>pt&gt;al</ins>e<ins>rt('Second</ins> <ins>line.')&lt;/script&gt;</ins>",
             "+<ins>L</ins>ine<ins> N°4</ins>",
             " Fifth line.",
             "-<del>Six</del>th line.",
@@ -705,9 +705,9 @@ public void editWithConflict(TestUtils setup, TestReference testReference)
         assertEquals(Arrays.asList("@@ -1,1 +1,1 @@",
             " First line.",
             "@@ -2,2 +2,2 @@",
-            "-<del>L</del>ine<del> N°2</del>",
+            "-<del>L</del>i<del>n</del>e <del>N°2</del>",
             "-<del>Th</del>i<del>rd li</del>ne<del>.</del>",
-            "+<ins>Second l</ins>ine<ins>.</ins>",
+            "+<ins>&lt;scr</ins>i<ins>pt&gt;al</ins>e<ins>rt('Second</ins> <ins>line.')&lt;/script&gt;</ins>",
             "+<ins>L</ins>ine<ins> N°4</ins>",
             "[Conflict Resolution]",
             "@@ -4,1 +4,1 @@",
@@ -727,7 +727,7 @@ public void editWithConflict(TestUtils setup, TestReference testReference)
 
         assertEquals(Conflict.DecisionType.CURRENT, conflict.getCurrentDecision());
         assertFalse(conflict.isDecisionChangeEmpty());
-        assertEquals("Second line.\nLine N°4", conflict.getDecisionChange());
+        assertEquals("<script>alert('Second line.')</script>\nLine N°4", conflict.getDecisionChange());
         conflict.setDecision(Conflict.DecisionType.PREVIOUS);
         assertFalse(conflict.isDecisionChangeEmpty());
         assertEquals("Second line.\nThird line.", conflict.getDecisionChange());

diff --git a/...iki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/diff_macros.vm b/...iki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/diff_macros.vm
@@ -82,7 +82,16 @@
   #else
     #set ($spanClass = "diff-decision")
   #end
-  <span class="$spanClass" id="$spanId">$stringtool.join($value, "<br/>")</span>
+
+## We do not want the renderer to add any extra spaces or linebreaks in this output.
+#* *#<span class="$spanClass" id="$spanId">##
+#*   *##foreach ($v in $value)
+#*     *#$escapetool.xml($v)##
+#*     *##if ($foreach.hasNext)
+#*       *#<br/>##
+#*     *##end
+#*   *##end
+#* *#</span>
 #end
 
 #macro (displayPropertyDiff $propertyName $previousValue $newValue $_obfuscate $conflicts $realPropertyName)