[JIRA] (JENKINS-62036) Issue parsers display incorrect data when message or description contains HTML

[msic...@cloudbees.com (JIRA)]

Title: Message Title

Matt Sicker created an issue   Jenkins / JENKINS-62036 Issue parsers display incorrect data when message or description contains HTML Issue Type: Bug Assignee: Ulli Hafner Components: warnings-ng-plugin Created: 2020-04-23 20:16 Priority: Minor Reporter: Matt Sicker All issue parsers in analysis-model extend IssueParser which need to parse a stream into a Report made up of Issue instances (among other thing). These Issue instances are usually created by extracting text from the console log or other log files. I haven't looked through all 100+ times it is used, but in the vast majority of cases, IssueBuilder.setMessage() is invoked with regex match groups, and those contents are treated as raw HTML (using the Unescaped class). Based on the various issue parsers I've used and looked at, they don't seem to expect HTML, though they can make use of it. Thanks to the use of the OWASP Markup Formatter, nothing malicious can be injected, but any supported HTML and special characters will be interpreted as such when parsed from the console log. Add Comment   This message was sent by Atlassian Jira (v7.13.12#713012-sha1:6e07c38) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.205927.1587672996000.16727.1587673020234%40Atlassian.JIRA.