SECURITY-2931

jenkinsci · Feb 8, 2023 · ebfb974 · ebfb974
1 parent 7b2bd25
commit ebfb974
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 5 deletions.
diff --git a/src/main/resources/hudson/plugins/emailext/templates/groovy-html-larry.template b/src/main/resources/hudson/plugins/emailext/templates/groovy-html-larry.template
@@ -46,7 +46,7 @@ img.cartoon {width: 36px; display:inline}
 						<td>${project.name}</td>
 					</tr>
 					<tr>
-						<th>Build ${build.displayName}:</th>
+						<th>Build ${hudson.Util.xmlEscape(build.displayName)}:</th>
 						<td><a
 							href="${rooturl}${build.url}">${rooturl}${build.url}</a></td>
 					</tr>

diff --git a/src/main/resources/hudson/plugins/emailext/templates/groovy-html.template b/src/main/resources/hudson/plugins/emailext/templates/groovy-html.template
@@ -78,7 +78,7 @@
     </tr>
     <tr>
       <td>Cause:</td>
-      <td><% build.causes.each() { cause -> %> ${cause.shortDescription} <%  } %></td>
+      <td><% build.causes.each() { cause -> %> ${hudson.Util.xmlEscape(cause.shortDescription)} <%  } %></td>
     </tr>
   </table>
   <br/>
@@ -208,7 +208,7 @@
       junitResult -> junitResult.getChildren().each {
         packageResult -> %>
     <tr>
-      <td>${packageResult.getName()}</td>
+      <td>${hudson.Util.xmlEscape(packageResult.getName())}</td>
       <td>${packageResult.getFailCount()}</td>
       <td>${packageResult.getPassCount()}</td>
       <td>${packageResult.getSkipCount()}</td>
@@ -218,15 +218,15 @@
         test -> %>
             <tr>
               <td class="test test-fixed" colspan="5">
-                ${test.getFullName()} ${test.getStatus()}
+                ${hudson.Util.xmlEscape(test.getFullName())} ${test.getStatus()}
               </td>
             </tr>
         <% } %>
         <% packageResult.getFailedTests().sort({a,b -> a.getAge() <=> b.getAge()}).each{
           failed_test -> %>
     <tr>
       <td class="test test-failed" colspan="5">
-        ${failed_test.getFullName()} (Age: ${failed_test.getAge()})
+        ${hudson.Util.xmlEscape(failed_test.getFullName())} (Age: ${failed_test.getAge()})
       </td>
     </tr>
         <% }