[FIXED JENKINS-31751]: Correctly escape HTML in jelly files.

jenkinsci · Dec 7, 2015 · 8651004 · 8651004
1 parent 5c79c78
commit 8651004
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/src/main/resources/hudson/plugins/jacoco/tags/breakdownMethodsTable.jelly b/src/main/resources/hudson/plugins/jacoco/tags/breakdownMethodsTable.jelly
@@ -7,7 +7,7 @@
         <td class="${h.ifThenElse(c.failed,' red','')}" style="white-space: normal;">
           <a href="${h.ifThenElse(nolink!=null,null,c.name+'/')}"><st:out value="${c.name}"/></a>
         </td>	      
-        ${c.printFourCoverageColumns()}
+        <j:out value="${c.printFourCoverageColumns()}"/>
       </tr>
     </j:forEach>
   </table>

diff --git a/src/main/resources/hudson/plugins/jacoco/tags/breakdownTable.jelly b/src/main/resources/hudson/plugins/jacoco/tags/breakdownTable.jelly
@@ -7,7 +7,7 @@
         <td class="nowrap ${h.ifThenElse(c.failed,' red','')}" >
           <a href="${h.ifThenElse(nolink!=null,null,c.name+'/')}"><st:out value="${c.name}"/></a>
         </td>	      
-        ${c.printFourCoverageColumns()}
+        <j:out value="${c.printFourCoverageColumns()}"/>
       </tr>
     </j:forEach>
   </table>

diff --git a/src/main/resources/hudson/plugins/jacoco/tags/summaryMethod.jelly b/src/main/resources/hudson/plugins/jacoco/tags/summaryMethod.jelly
@@ -4,7 +4,7 @@
     <e:captionLine />
     <tr>
       <td>${title}</td>
-      ${it.printFourCoverageColumns()}
+      <j:out value="${it.printFourCoverageColumns()}"/>
     </tr>
   </table>
 </j:jelly>
diff --git a/src/main/resources/hudson/plugins/jacoco/tags/summaryTable.jelly b/src/main/resources/hudson/plugins/jacoco/tags/summaryTable.jelly
@@ -4,7 +4,7 @@
     <e:captionLine />
     <tr>
       <td>${title}</td>
-      ${it.printFourCoverageColumns()}
+      <j:out value="${it.printFourCoverageColumns()}"/>
     </tr>
   </table>
 </j:jelly>