SECURITY-2692

jenkinsci · Apr 5, 2022 · 0a51bfe · 0a51bfe
1 parent 6c1d276
commit 0a51bfe
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/...es/hudson/plugins/promoted_builds/parameters/PromotedBuildParameterDefinition/index.jelly b/...es/hudson/plugins/promoted_builds/parameters/PromotedBuildParameterDefinition/index.jelly
@@ -26,7 +26,8 @@ THE SOFTWARE.
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">
-	<f:entry title="${it.name}" description="${it.description}">
+	<j:set var="escapeEntryTitleAndDescription" value="false"/>
+	<f:entry title="${h.escape(it.name)}" description="${it.formattedDescription}">
 		<div name="parameter" description="${it.description}">
 			<input type="hidden" name="name" value="${it.name}" />
             <select name="runId">

diff --git a/...sources/hudson/plugins/promoted_builds/parameters/PromotedBuildParameterValue/value.jelly b/...sources/hudson/plugins/promoted_builds/parameters/PromotedBuildParameterValue/value.jelly
@@ -26,7 +26,8 @@ THE SOFTWARE.
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">
-	<f:entry title="${it.name}" description="${it.description}">
+    <j:set var="escapeEntryTitleAndDescription" value="false"/>
+    <f:entry title="${h.escape(it.name)}" description="${it.formattedDescription}">
         <div name="parameter">
             <a href="${rootURL}/${it.run.url}">${it.run.fullDisplayName}</a>
             <input type="hidden" name="name" value="${it.name}" />