Page MenuHomePhabricator

Visual editor doesn't escape greater-than in template parameters
Closed, InvalidPublic


Repeat by:

  1. Edit a page using the Visual Editor.
  2. Insert a "citation needed" template
  3. Add a "Reason for citation" field
  4. Enter "this -> that" as the "Reason for citation" text
  5. Save the page

This resulted in wikitext:

foo{{Citation needed|date=December 2018|reason=this -> that}}

which rendered as:

<span title="this -"> that (December 2018)"&gt;citation needed</span>

Event Timeline

RoySmith created this task.Dec 12 2018, 2:23 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 12 2018, 2:23 PM

Chrome Version 70.0.3538.110 (Official Build) (64-bit)
MacOS 10.13.6 (17G3025)

matmarex closed this task as Invalid.Dec 12 2018, 8:44 PM
matmarex claimed this task.
matmarex added a subscriber: matmarex.

Thanks for the bug report!

I think this is the expected behavior – unfortunately, when you edit a template inside VisualEditor, the template parameters are only editable as wikitext and not visually :( (see T52355). So whatever you type in the template dialog, will be included exactly as-is in the output wikitext.

By typing this -> that into the "Reason" field, you end up with |reason=this -> that in the output wikitext.

The messed up rendering of that wikitext is weird, but it's not a problem with VisualEditor. The same problem appears for the wikitext <span title="this -> that">citation needed</span> (without using the template). The behavior of the wikitext parser here is definitely questionable. I filed a separate task about this problem: T211816: Wikitext parsing of unescaped < and > inside tag attributes is unexpected (different from HTML rules).

I guess you need to manually replace the > with &gt;. (Also, perhaps the "Citation needed" template on English Wikipedia could be made to magically apply this replacement automatically? Try asking on the discussion page there.)