SECURITY-2690

jenkinsci · Apr 6, 2022 · d2db016 · d2db016
1 parent fd56f46
commit d2db016
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/...in/resources/com/cloudbees/plugins/credentials/CredentialsParameterDefinition/index.jelly b/...in/resources/com/cloudbees/plugins/credentials/CredentialsParameterDefinition/index.jelly
@@ -27,7 +27,8 @@
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
          xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
          xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project" xmlns:c="/lib/credentials">
-  <f:entry title="${it.name}" description="${it.description}">
+  <j:set var="escapeEntryTitleAndDescription" value="false"/>
+  <f:entry title="${h.escape(it.name)}" description="${it.formattedDescription}">
     <div name="parameter" description="${it.description}">
       <input type="hidden" name="name" value="${it.name}" />
       <input type="hidden" name="credentialType" value="${it.credentialType}" />

diff --git a/src/main/resources/com/cloudbees/plugins/credentials/CredentialsParameterValue/value.jelly b/src/main/resources/com/cloudbees/plugins/credentials/CredentialsParameterValue/value.jelly
@@ -25,7 +25,8 @@
 
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:f="/lib/form" xmlns:c="/lib/credentials" xmlns:l="/lib/layout">
-	<f:entry title="${it.name}" description="${it.description}">
+	<j:set var="escapeEntryTitleAndDescription" value="false"/>
+	<f:entry title="${h.escape(it.name)}" description="${it.formattedDescription}">
 		<j:set var="url" value="${it.url()}"/>
 		<j:choose>
 			<j:when test="${url!=null and !url.isEmpty()}">