XCOMMONS-2534: Provide a method to escape content passed to wiki macro list parameters

xwiki-commons-core/xwiki-commons-velocity/src/main/java/org/xwiki/velocity/tools/EscapeTool.java

@@ -32,6 +32,7 @@
 import org.apache.commons.text.StringEscapeUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.xwiki.stability.Unstable;
 import org.xwiki.xml.XMLUtils;
 
 /**
@@ -66,6 +67,8 @@ public class EscapeTool extends org.apache.velocity.tools.generic.EscapeTool
     /** And sign. */
     private static final String AND = "&";
 
+    private XWiki21EscapeTool xWiki21EscapeTool = new XWiki21EscapeTool(this);
+
     /**
      * Change the default key defined in {@link org.apache.velocity.tools.generic.EscapeTool}.
      */
@@ -273,4 +276,14 @@ public String url(Object string)
         }
         return encodedURL;
     }
+
+    /**
+     * @return an instance of escapetool specific for {@code xwiki/21}
+     * @since 14.9RC1
+     */
+    @Unstable
+    public XWiki21EscapeTool getXwiki21()
+    {
+        return this.xWiki21EscapeTool;
+    }
 }

xwiki-commons-core/xwiki-commons-velocity/src/main/java/org/xwiki/velocity/tools/XWiki21EscapeTool.java

@@ -0,0 +1,70 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.velocity.tools;
+
+import org.apache.commons.lang3.StringUtils;
+import org.xwiki.stability.Unstable;
+
+/**
+ * @version $Id$
+ * @since 14.9RC1
+ */
+@Unstable
+public class XWiki21EscapeTool
+{
+    private EscapeTool escapeTool;
+
+    /**
+     * Default constructor.
+     *
+     * @param escapeTool the main escape tool
+     */
+    public XWiki21EscapeTool(EscapeTool escapeTool)
+    {
+        this.escapeTool = escapeTool;
+    }
+
+    /**
+     * Escape values to safely use them as parameters of a xwiki macro expecting an array or a collection.
+     *
+     * @param values the values to escape
+     * @return the escaped value
+     */
+    public String parameterArray(String... values)
+    {
+        String[] ret = new String[values.length];
+        for (int valuesIndex = 0; valuesIndex < values.length; valuesIndex++) {
+            ret[valuesIndex] = String.valueOf(parameterArray(values[valuesIndex]));
+        }
+        return StringUtils.join(ret, ",");
+    }
+
+    private char[] parameterArray(String value)
+    {
+        String javaEscaped = String.format("\"%s\"", this.escapeTool.java(value));
+        char[] xwiki21Escaped = new char[javaEscaped.length() * 2];
+        for (int i = 0; i < javaEscaped.length(); i++) {
+            // TODO: duplicated?
+            xwiki21Escaped[i * 2] = '~';
+            xwiki21Escaped[(i * 2) + 1] = javaEscaped.charAt(i);
+        }
+        return xwiki21Escaped;
+    }
+}

xwiki-commons-core/xwiki-commons-velocity/src/test/java/org/xwiki/velocity/tools/XWiki21EscapeToolTest.java

@@ -0,0 +1,45 @@
+/*
+ * See the NOTICE file distributed with this work for additional
+ * information regarding copyright ownership.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
+package org.xwiki.velocity.tools;
+
+import org.junit.jupiter.api.Test;
+import org.xwiki.test.junit5.mockito.ComponentTest;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * Test of {@link XWiki21EscapeTool}.
+ *
+ * @version $Id$
+ * @since 14.9RC1
+ */
+@ComponentTest
+class XWiki21EscapeToolTest
+{
+    private final XWiki21EscapeTool xWiki21EscapeTool = new XWiki21EscapeTool(new EscapeTool());
+
+    @Test
+    void parameterArray()
+    {
+        assertEquals("~\"~a~\"", this.xWiki21EscapeTool.parameterArray("a"));
+        assertEquals("~\"~a~\",~\"~b~\"", this.xWiki21EscapeTool.parameterArray("a", "b"));
+        assertEquals("~\"~a~\\~\"~\",~\"~b~\"", this.xWiki21EscapeTool.parameterArray("a\"", "b"));
+    }
+}