Skip to content

[JENKINS-22028] HTML in job description does not get rendered (all html tags escaped) #22924

Closed
Bug
Closed
[JENKINS-22028] HTML in job description does not get rendered (all html tags escaped)#22924
Bug
Labels
component:coreimported-jira-issuepriority:majorresolution:fixed

Description

@jenkins-infra-bot
jenkins-infra-bot
opened on Mar 4, 2014

We have html job descriptions for most of our jobs. Since upgrading to the latest jenkins version 1.553 (from 1.538) the html tags do not get rendered. Instead plain html code is shown.

The same applies for the "Preview" when editing the job description.

Originally reported by stefanthurnherr, imported from: HTML in job description does not get rendered (all html tags escaped)
  • status: Resolved
  • priority: Major
  • component(s): core
  • resolution: Fixed
  • resolved: 2015-12-09T13:47:44+00:00
  • votes: 10
  • watchers: 20
  • imported: 2025-11-24
Raw content of original issue 
We have html job descriptions for most of our jobs. Since upgrading to the latest jenkins version 1.553 (from 1.538) the html tags do not get rendered. Instead plain html code is shown.



The same applies for the "Preview" when editing the job description.
  • environment: Ubuntu, Tomcat 7.0.52, jenkins war distribution
1 attachment

Activity

  1. jenkins-infra-bot commented on Mar 5, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 5, 2014
    Author
    cb372:
    • Original comment link
    • Raw content of original comment: 
      Same problem here after upgrading to 1.553. This entry from the changelog looks suspicious:
      


      Split the “raw HTML” markup formatter out of core into a bundled plugin.

    Same problem here after upgrading to 1.553. This entry from the changelog looks suspicious:

    Split the “raw HTML” markup formatter out of core into a bundled plugin.

  2. jenkins-infra-bot commented on Mar 5, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 5, 2014
    Author
    belpk:
    • Original comment link
    • Raw content of original comment: 
      Same issue since 1.553.
      


      Images (from /userContent) and links aren't rendered anymore, only shown as plain HTML. Which is hindering usability...
      


      Addition: this not only applies to job descriptions, but also elsewhere, e.g. the system message that can be configured in the system-wide configuration settings and gets displayed on the top page.

    Same issue since 1.553.

    Images (from /userContent) and links aren't rendered anymore, only shown as plain HTML. Which is hindering usability...

    Addition: this not only applies to job descriptions, but also elsewhere, e.g. the system message that can be configured in the system-wide configuration settings and gets displayed on the top page.

  3. jenkins-infra-bot commented on Mar 5, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 5, 2014
    Author
    albers:
    • Original comment link
    • Raw content of original comment: 
      In 1.553 the Raw HTML Formatter was moved to the new antisamy-markup-formatter plugin.
This seems to have changed the default HTML formatter from Raw HTML to Escaped HTML, which escapes all HTML.
You can restore the original behavior by selecting Raw HTML as the Markup Formatter on the Configure Global Security page.

    In 1.553 the Raw HTML Formatter was moved to the new antisamy-markup-formatter plugin.
    This seems to have changed the default HTML formatter from Raw HTML to Escaped HTML, which escapes all HTML.
    You can restore the original behavior by selecting Raw HTML as the Markup Formatter on the Configure Global Security page.

  4. jenkins-infra-bot commented on Mar 5, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 5, 2014
    Author
    gpatten:
    • Original comment link
    • Raw content of original comment: 
      I'm seeing this same issue with 1.553.
      


      On the Configure Global Security page my only options are Enable security and Prevent Cross Site Request Forgery Exploits.  I'm not seeing a Markup Formatter option on that page.

    I'm seeing this same issue with 1.553.

    On the Configure Global Security page my only options are Enable security and Prevent Cross Site Request Forgery Exploits. I'm not seeing a Markup Formatter option on that page.

  5. jenkins-infra-bot commented on Mar 5, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 5, 2014
    Author
    albers:
    • Original comment link
    • Raw content of original comment: 
      The Markup Formatter option is only available if you Enable security.
      


      It's a bit strange that you first have to enable security in order to change the formatter to a potentially dangerous one. This would make more sense if the default formatter were Escaped HTML.
      


      I think the default formatter should be Raw HTML and the Markup Formatter option should be moved directly to the Configure Global Security page, just like Prevent Cross Site Request Forgery Exploits,

    The Markup Formatter option is only available if you Enable security.

    It's a bit strange that you first have to enable security in order to change the formatter to a potentially dangerous one. This would make more sense if the default formatter were Escaped HTML.

    I think the default formatter should be Raw HTML and the Markup Formatter option should be moved directly to the Configure Global Security page, just like Prevent Cross Site Request Forgery Exploits,

  6. jenkins-infra-bot commented on Mar 6, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 6, 2014
    Author
    stefanthurnherr:
    • Original comment link
    • Raw content of original comment: 
      The workaround described above worked for us: 
"Configure Global Security" -> Check "Enable Security" -> Choose Markup Formatter = "Raw HTML", then pressing "Save" (without selecting any other option).
      


      Interestingly, when going to "Configure Global Security" again, the checkbox "Enable Security" is unchecked again. But still the default for Markup Formatter has been changed to "Raw HTML". So I agree that the the option Markup Formatter should probably be moved out of "Enable Security".

    The workaround described above worked for us:
    "Configure Global Security" -> Check "Enable Security" -> Choose Markup Formatter = "Raw HTML", then pressing "Save" (without selecting any other option).

    Interestingly, when going to "Configure Global Security" again, the checkbox "Enable Security" is unchecked again. But still the default for Markup Formatter has been changed to "Raw HTML". So I agree that the the option Markup Formatter should probably be moved out of "Enable Security".

  7. jenkins-infra-bot commented on Apr 7, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Apr 7, 2014
    Author
    pablaasmo:
    • Original comment link
    • Raw content of original comment: 
      I am not sure this is related, but I can't see an iframe in the description get rendered any more. I was rendered before and now it is not. 
I do have RAW HTML enabled and other HTML is rendered OK.

    I am not sure this is related, but I can't see an iframe in the description get rendered any more. I was rendered before and now it is not.
    I do have RAW HTML enabled and other HTML is rendered OK.

  8. jenkins-infra-bot commented on Apr 14, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Apr 14, 2014
    Author
    exelerus:
    • Original comment link
    • Raw content of original comment: 
      We have the same problem with iframes defined in the description fields not being rendered. All other HTML works fine though.

    We have the same problem with iframes defined in the description fields not being rendered. All other HTML works fine though.

  9. jenkins-infra-bot commented on Apr 22, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on Apr 22, 2014
    Author
    wesleyarchbell:
    • Original comment link
    • Raw content of original comment: 
      I have the same issue when migrating from 1.538 to 1.560

    I have the same issue when migrating from 1.538 to 1.560

  10. jenkins-infra-bot commented on May 6, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on May 6, 2014
    Author
    bindwood:
    • Original comment link
    • Raw content of original comment: 
      I have the same problem on the Jenkinswhich install on Windows(sinice update to 1.555 or later, I think) , but the Jenkins which install on suse works well

    I have the same problem on the Jenkinswhich install on Windows(sinice update to 1.555 or later, I think) , but the Jenkins which install on suse works well

  11. jenkins-infra-bot commented on May 6, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on May 6, 2014
    Author
    danielbeck:

    pablaasmo: Contrary to what the name indicates, "Raw HTML" doesn't allow potentially unsafe HTML (like iframes). Use the Anything goes Formatter for this.

  12. jenkins-infra-bot commented on May 11, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on May 11, 2014
    Author
    danielbeck:

    Allow configuring the markup formatter without requiring "Enable Security":
    #1235

    Change the display name and description of the bundled 'Raw HTML' formatter plugin to match its behavior:
    jenkinsci/antisamy-markup-formatter-plugin#1

  13. jenkins-infra-bot commented on May 12, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on May 12, 2014
    Author
    dogfood:
    • Original comment link
    • Raw content of original comment: 
      Integrated in  jenkins_main_trunk #3374
     [FIX JENKINS-22028] Allow MarkupFormatter without enabling security (Revision ac3a5cd61461c5f7f063c57fba81a5aec6409664)
JENKINS-22028 Noting merge of #1235. (Revision f3943a4ef707697e4cd512463c81b07f9bec95bc)
      


           Result = SUCCESS
daniel-beck : ac3a5cd61461c5f7f063c57fba81a5aec6409664
Files : 
      

        
	
      • core/src/main/resources/hudson/security/GlobalSecurityConfiguration/index.groovy
        • 
	
      • core/src/main/java/hudson/security/GlobalSecurityConfiguration.java
        • 
	
      • core/src/main/java/jenkins/model/Jenkins.java
        • 

      



      Jesse Glick : f3943a4ef707697e4cd512463c81b07f9bec95bc
Files : 
      

        
	
      • changelog.html
        •

    Integrated in jenkins_main_trunk #3374
    [FIX JENKINS-22028] Allow MarkupFormatter without enabling security (Revision ac3a5cd)
    JENKINS-22028 Noting merge of #1235. (Revision f3943a4)

    Result = SUCCESS
    daniel-beck : ac3a5cd61461c5f7f063c57fba81a5aec6409664
    Files :

    • core/src/main/resources/hudson/security/GlobalSecurityConfiguration/index.groovy
    • core/src/main/java/hudson/security/GlobalSecurityConfiguration.java
    • core/src/main/java/jenkins/model/Jenkins.java

    Jesse Glick : f3943a4ef707697e4cd512463c81b07f9bec95bc
    Files :

    • changelog.html

  14. jenkins-infra-bot commented on May 15, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on May 15, 2014
    Author
    danielbeck:
    • Original comment link
    • Raw content of original comment: 
      The currently unreleased Jenkins 1.564 will allow selection of a markup formatter even with security disabled (similar to the CSRF protection).
      


      Additionally, changed name and description of 'Raw HTML' formatter to better reflect what it actually does. Will be part of the next release of the antisamy-markup-formatter plugin.
      


      In case of no existing security configuration, the default was changed from Raw/Safe HTML to Escaped HTML in 1.553. I don't think this is bad enough to warrant additional backwards compatibility changes as it's easily changed in the config, especially in 1.564 onward. Therefore I'm closing this.
      


      If you experience this issue, update to Jenkins 1.564 or newer and select 'Raw HTML' or 'Safe HTML' on the Configure Global Security page.

    The currently unreleased Jenkins 1.564 will allow selection of a markup formatter even with security disabled (similar to the CSRF protection).

    Additionally, changed name and description of 'Raw HTML' formatter to better reflect what it actually does. Will be part of the next release of the antisamy-markup-formatter plugin.

    In case of no existing security configuration, the default was changed from Raw/Safe HTML to Escaped HTML in 1.553. I don't think this is bad enough to warrant additional backwards compatibility changes as it's easily changed in the config, especially in 1.564 onward. Therefore I'm closing this.

    If you experience this issue, update to Jenkins 1.564 or newer and select 'Raw HTML' or 'Safe HTML' on the Configure Global Security page.

  15. jenkins-infra-bot commented on May 19, 2014

    @jenkins-infra-bot
    jenkins-infra-bot
    on May 19, 2014
    Author
    scm_issue_link:
    • Original comment link
    • Raw content of original comment: 
      Code changed in jenkins
User: Daniel Beck
Path:
 core/src/main/java/hudson/security/GlobalSecurityConfiguration.java
 core/src/main/java/jenkins/model/Jenkins.java
 core/src/main/resources/hudson/security/GlobalSecurityConfiguration/index.groovy
http://jenkins-ci.org/commit/jenkins/ac3a5cd61461c5f7f063c57fba81a5aec6409664
Log:
  [FIX JENKINS-22028] Allow MarkupFormatter without enabling security
      


      Given the current default of 'Escaped HTML', it makes no sense
to require users to 'Enable Security' to set up a less secure
alternative. So show it on the global security configuration page
on top level.

    Code changed in jenkins
    User: Daniel Beck
    Path:
    core/src/main/java/hudson/security/GlobalSecurityConfiguration.java
    core/src/main/java/jenkins/model/Jenkins.java
    core/src/main/resources/hudson/security/GlobalSecurityConfiguration/index.groovy
    http://jenkins-ci.org/commit/jenkins/ac3a5cd61461c5f7f063c57fba81a5aec6409664
    Log:
    [FIX JENKINS-22028] Allow MarkupFormatter without enabling security

    Given the current default of 'Escaped HTML', it makes no sense
    to require users to 'Enable Security' to set up a less secure
    alternative. So show it on the global security configuration page
    on top level.

  16. 13 remaining items

  17. jenkins-infra-bot commented on Jun 19, 2015

    @jenkins-infra-bot
    jenkins-infra-bot
    on Jun 19, 2015
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Radek Antoniuk
    Path:
    core/src/main/resources/hudson/markup/Messages.properties
    http://jenkins-ci.org/commit/jenkins/d758818b09ecd8d3eebebc927409e0ed58b2938a
    Log:
    JENKINS-22028 - update label to reflect actual behavior

  18. jenkins-infra-bot commented on Jun 19, 2015

    @jenkins-infra-bot
    jenkins-infra-bot
    on Jun 19, 2015
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Daniel Beck
    Path:
    core/src/main/resources/hudson/markup/Messages.properties
    http://jenkins-ci.org/commit/jenkins/107a502db4a55122f9be13ef0e31bebde8fe733d
    Log:
    Merge pull request #1742 from QUIDDIA/master

    JENKINS-22028 update label to reflect actual behavior

    Compare: 76f4c35...107a502

  19. jenkins-infra-bot commented on Dec 9, 2015

    @jenkins-infra-bot
    jenkins-infra-bot
    on Dec 9, 2015
    Author
    jsdevel:
    • Original comment link
    • Raw content of original comment: 
      Reopening as the initial fix only changed the display name, not the info message (see screenshot).  Verified in 1.625.2

    Reopening as the initial fix only changed the display name, not the info message (see screenshot). Verified in 1.625.2

  20. jenkins-infra-bot commented on Dec 9, 2015

    @jenkins-infra-bot
    jenkins-infra-bot
    on Dec 9, 2015
    Author
    jsdevel:

    Pending PR https://github.com/kogosoftwarellc/jenkins/pull/1

  21. jenkins-infra-bot commented on Dec 9, 2015

    @jenkins-infra-bot
    jenkins-infra-bot
    on Dec 9, 2015
    Author
    danielbeck:
    • Original comment link
    • Raw content of original comment: 
      First, the message is true. It's just that you did not enable markup formatting, so there's no formatting applied.
      


      Second, nobody on this tracker cares about PRs to your own forks of Jenkins.

    First, the message is true. It's just that you did not enable markup formatting, so there's no formatting applied.

    Second, nobody on this tracker cares about PRs to your own forks of Jenkins.

  22. jenkins-infra-bot
    closed this as completedon Dec 9, 2015
  23. jenkins-infra-bot
    added
    bugFor changelog: Minor bug. Will be listed after features
    imported-jira-issue
    component:core
    priority:major
    resolution:fixed
    on Nov 24, 2025

  24. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original is_duplicated_by from Jira: JENKINS-22266]

  25. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original relates_to from Jira: JENKINS-26565]

  26. jenkins-infra-bot
    added the
    Bug
    issue type on Nov 25, 2025
  27. jenkins-infra-bot
    removed
    bugFor changelog: Minor bug. Will be listed after features
    on Nov 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    component:coreimported-jira-issuepriority:majorresolution:fixed

    Type

    Bug

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions