SECURITY-2703

jenkinsci · Apr 5, 2022 · 8b1d596 · 8b1d596
1 parent 854934e
commit 8b1d596
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/...s/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/rebuild.jelly b/...s/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/rebuild.jelly
@@ -26,7 +26,8 @@ THE SOFTWARE.
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
         xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
         xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">
-        <f:entry title="${it.name}" description="${it.description}">
+        <j:set var="escapeEntryTitleAndDescription" value="false"/>
+        <f:entry title="${h.escape(it.name)}" description="${it.formattedDescription}">
             <div name="parameter" description="${it.description}">
                 <input type="hidden" name="name" value="${it.name}" />
                 <f:textbox name="value" value="${it.value}" readonly="true" />

diff --git a/...ins/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/value.jelly b/...ins/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/value.jelly
@@ -26,7 +26,8 @@ THE SOFTWARE.
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
         xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
         xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">
-        <f:entry title="${it.name}" description="${it.description}">
+        <j:set var="escapeEntryTitleAndDescription" value="false"/>
+        <f:entry title="${h.escape(it.name)}" description="${it.formattedDescription}">
             <input type="hidden" name="name" value="${it.name}" />
             <f:textbox name="value" value="${it.value}" readonly="true" />
         </f:entry>