allow links and formatting in causeString

pom.xml

@@ -197,6 +197,11 @@
 			<artifactId>commons-ip-math</artifactId>
 			<version>1.32</version>
 		</dependency>
+		<dependency>
+			<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
+			<artifactId>owasp-java-html-sanitizer</artifactId>
+			<version>20211018.2</version>
+		</dependency>
 
 		<!-- test // -->
 		<dependency>

src/main/java/org/jenkinsci/plugins/gwt/GenericCause.java

@@ -4,6 +4,8 @@
 
 import hudson.model.Cause;
 import java.util.Map;
+import org.owasp.html.PolicyFactory;
+import org.owasp.html.Sanitizers;
 
 public class GenericCause extends Cause {
 
@@ -48,6 +50,7 @@ public String getPostContent() {
 
   @Override
   public String getShortDescription() {
-    return cause;
+    PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
+    return policy.sanitize(cause);
   }
 }

src/main/resources/org/jenkinsci/plugins/gwt/GenericCause/description.jelly

@@ -0,0 +1,4 @@
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
+    <span><j:out value="${it.getShortDescription()}"/></span>
+</j:jelly>

src/test/java/org/jenkinsci/plugins/gwt/GenericCauseTest.java

@@ -0,0 +1,37 @@
+package org.jenkinsci.plugins.gwt;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import hudson.model.Cause;
+import org.junit.Test;
+
+public class GenericCauseTest {
+
+  @Test
+  public void sanitizeCauseStringTest() {
+
+    Cause cause =
+        new GenericCause(
+            null,
+            null,
+            false,
+            false,
+            "<b>Triggered by:</b> <a href=\"https://test.org/pr/1\">PR 1</a>");
+
+    String expected =
+        "<b>Triggered by:</b> <a href=\"https://test.org/pr/1\" rel=\"nofollow\">PR 1</a>";
+
+    assertThat(expected).isEqualTo(cause.getShortDescription());
+
+    cause =
+        new GenericCause(
+            null,
+            null,
+            false,
+            false,
+            "<b>Triggered by:</b> PR 1<div><script>somethingBad()</script></div>");
+    expected = "<b>Triggered by:</b> PR 1";
+
+    assertThat(expected).isEqualTo(cause.getShortDescription());
+  }
+}