templates: escape the authored field label into every Harmonia JS/Alpine interpolation (#7294) - #7314
Merged
delchev merged 1 commit intoSep 11, 2026
Conversation
…ine interpolation (eclipse-dirigible#7294) Same defect class as eclipse-dirigible#7205/eclipse-dirigible#7206/eclipse-dirigible#7207: an authored string (this time the field `label:`, eclipse-dirigible#6424) was interpolated verbatim into single-quoted JS string literals and Alpine T() call arguments across the Harmonia templates. `label: "Owner's copy"` closed the literal early - the report page's column list became a syntax error (blank page), and in the form/master/list/document views the apostrophe ended the T() fallback argument inside an Alpine x-text expression, throwing at evaluation and aborting the walk of the enclosing element. Resolve a `widgetLabelJs` (JsLiterals.escape(widgetLabel)) once in ModelParameterProcessor, the same way widgetPatternJs/dataDefaultValueJsLiteral already are, and route every JS-string/Alpine-expression interpolation of the label through it: the my/partner/main form and document views, the list/master/ report page+view templates, and the item-dialog's detail-register. Plain HTML text content (the report table header) is untouched - an apostrophe there is harmless. Verified: ide-template unit tests (JsLiteralsTest, ModelParameterProcessorTest, 143/143); a new IntentEngineIT test declaring an apostrophe-carrying label and asserting the escaped literal reaches the form, master page and item-dialog register (and never the raw apostrophe); the full IntentEngineIT class (78/78, no regressions); repo-wide `mvn formatter:validate` (BUILD SUCCESS). Fixes eclipse-dirigible#7294 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Same defect class as
#7205/#7206/#7207: an authored string - this time the fieldlabel:(#6424,widgetLabel) - was interpolated verbatim into single-quoted JS string literals and AlpineT()call arguments across the Harmonia templates.label: "Owner's copy"closes the literal early: the report page's column list becomes a syntax error (blank page), and in the form/master/list/document views the apostrophe ends theT()fallback argument inside an Alpinex-textexpression, throwing at evaluation and aborting the walk of the enclosing element.widgetLabelJs(JsLiterals.escape(widgetLabel)) once inModelParameterProcessor, the same waywidgetPatternJs/dataDefaultValueJsLiteralalready are, and route every JS-string/Alpine-expression interpolation of the label through it: the my/partner/main form and document views, the list/master/report page+view templates, and the item-dialog's detail-register.table-view.html.template) is left untouched - an apostrophe there is harmless (no HTML escaping needed for'in text content, and this issue is scoped to the JS/Alpine interpolation defect).Test plan
mvn -pl components/ide/ide-template -am test—JsLiteralsTest/ModelParameterProcessorTestand the rest of the module, 143/143 greenIntentEngineITtest (an_authored_label_is_escaped_into_every_harmonia_interpolation) declaring a field withlabel: "Owner's copy"and asserting the escaped literal reaches the form, the master page and the item-dialog register — and the raw, unescaped apostrophe never doesIntentEngineITclass — 78/78, no regressions from the template editsmvn formatter:validate(repo-wide) —BUILD SUCCESSFixes #7294
🤖 Generated with Claude Code