Skip to content

Fix xdoc generator to HTML-escape content of {@code} and {@literal} tags - #619

Open
gnodet wants to merge 2 commits into
codehaus-plexus:masterfrom
gnodet:fix/xdoc-code-tag-escaping
Open

gnodet wants to merge 2 commits into
codehaus-plexus:masterfrom
gnodet:fix/xdoc-code-tag-escaping

Conversation

@gnodet

@gnodet gnodet commented Oct 23, 2026

Copy link
Copy Markdown
Member

Problem

The chhorz javadoc-parser wraps {@code X} content verbatim in <code>X</code> without HTML-escaping X. When X contains angle brackets (e.g. {@code <element>}), Jsoup subsequently parses <element> as an unknown HTML tag and silently drops it from the XML output — the tag name disappears from the generated site.

This is the root cause of apache/maven#13675, where descriptions such as:

  • {@code <activeProfiles>}
  • {@code <activation>}
  • {@code <name>value</name>}

all render with the angle-bracket content missing on the published Maven site.

Root cause trace

In XdocGenerator.rewrite():

  1. The MXParser XML parser reads a <description> outside CDATA and decodes &lt; → <. So {@code &lt;element&gt;} in the .mdo file becomes {@code <element>} in the description string.
  2. The javadoc-parser produces <code><element></code> — the content is not HTML-escaped.
  3. Jsoup, in XML output mode, treats <element> as an unknown element and drops it silently.

Fix

Pre-process {@code} and {@literal} inline tags in XdocGenerator.rewrite() to HTML-escape their content before the javadoc-parser and Jsoup pipeline see it.

The escapeHtml() helper normalises pre-existing &lt;/&gt; entities first (which appear in CDATA-wrapped .mdo descriptions) so both forms are handled correctly and produce identical correct output:

  • {@code <element>} (XML-decoded) → <code>&lt;element&gt;</code> ✓
  • {@code &lt;element&gt;} (from CDATA) → <code>&lt;element&gt;</code> ✓

Test

Added a field with {@code &lt;name&gt;value&lt;/name&gt;} (outside CDATA, so MXParser decodes it to {@code <name>value</name>}) to html4.mdo and verified the expected output <code>&lt;name&gt;value&lt;/name&gt;</code> in html4.expected.xml.

The chhorz javadoc-parser wraps {@code X} content verbatim in <code>X</code>
without HTML-escaping X. When X contains angle brackets (e.g. {@code <element>}),
Jsoup subsequently parses <element> as an unknown HTML tag and silently drops it
from the XML output, causing the tag name to disappear from the generated site.

This is visible in Maven's settings reference where descriptions such as
  {@code <activeProfiles>}  and  {@code <activation>}
rendered with the tag name missing on the published site.

Fix: pre-process {@code} and {@literal} inline tags in XdocGenerator.rewrite()
by HTML-escaping their content before the javadoc-parser and Jsoup pipeline see
it. The escapeHtml() helper normalises pre-existing &lt;/&gt; entities first
(which appear in CDATA-wrapped .mdo descriptions) so both forms are handled
correctly and produce identical output.

Add a test case to html4.mdo / html4.expected.xml that exercises the fix with
{@code &lt;name&gt;value&lt;/name&gt;} (decoded to {@code <name>value</name>}
by MXParser) and verifies <code>&lt;name&gt;value&lt;/name&gt;</code> in output.

@gnodet-bot gnodet-bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

preprocessInlineCodeTags replaces both {@code ...} and {@literal ...} with <code>...</code>, but the chhorz parser maps {@literal} to <i>...</i> (italic), not <code>. By preprocessing both tags to <code>, the method silently changes the rendering semantic for @literal.

Two smaller issues noted as well.

This review was generated by an AI agent, Hermès on behalf of @gnodet.

…ent, add trailing newline

- Use <i>...</i> for {@literal} and <code>...</code> for {@code},
  matching chhorz parser semantics (was always <code> for both)
- Change non-capturing group to capturing group in INLINE_CODE_TAG_PATTERN
  so the tag name is available as group(1) and content shifts to group(2)
- Qualify Javadoc comment: 'including one level of nested braces'
  (the regex only handles one level, not arbitrary nesting)
- Add missing trailing newline to html4.expected.xml

@gnodet-bot gnodet-bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Following up on my earlier review — all 3 findings have been addressed.

✅ {@literal} rendering — fixed by capturing the tag name via m.group(1) and using the ternary to emit <i>...</i> or <code>...</code> accordingly.
✅ Nesting comment — qualified to "one level of nested braces".
✅ Missing trailing newline — added to html4.expected.xml.

Pre-fix validation: tested XdocGeneratorTest#testHtmlToXml against the base commit — test fails (Jsoup silently drops <name>value</name> leaving <code></code>). With the fix it passes. The test correctly exercises the fixed code path.

The implementation is clean: escapeHtml() normalises pre-existing entities first to avoid double-escaping, and the regex correctly limits nesting to one level (as now documented). LGTM.

This review was generated by an AI agent, Hermès on behalf of @gnodet.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants