Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

display name contains "<" and/or ">" (<init> for example) normally #139

Merged
merged 1 commit into from
Feb 11, 2020

Conversation

afkbrb
Copy link
Contributor

@afkbrb afkbrb commented Jan 21, 2020

Before this change, this api plugin would display "<init>" method as "&amp;lt;init&amp;gt;" when showing coverage report for the method.

escape

Generally, this bug occurs when the method name contains "<" and/or ">". Let's still take "<init>" for example, after the process of io.jenkins.plugins.coverage.targets.CoverageResult#xmlTransform, this name will be "&lt;init&gt;", then since the corresponding jelly file's escape-by-default property is true, the name will be further escaped to "&amp;lt;init&amp;gt;".

When displaying the method name, the text is displayed "as is", so escaping is not necessary. So this PR won't lead to XSS issues.

After this change, the display will work fine.

escape-reverse

@afkbrb afkbrb requested a review from cizezsy January 21, 2020 09:42
Copy link
Contributor

@cizezsy cizezsy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks~

@cizezsy cizezsy merged commit 2c4d3f0 into jenkinsci:dev Feb 11, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants