Merge pull request #30 from oleg-nenashev/JENKINS-49302

[JENKINS-49302] - Fix escaping of summary reports.
jenkinsci · Feb 3, 2018 · f00f27b · f00f27b
2 parents 2fb99d0 + 47efb72
commit f00f27b
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 8 deletions.
diff --git a/src/main/java/hudson/plugins/testlink/util/TestLinkHelper.java b/src/main/java/hudson/plugins/testlink/util/TestLinkHelper.java
@@ -339,7 +339,7 @@ public static EnvVars buildTestCaseEnvVars(int numberOfTests, TestProject testPr
 	public static String createReportSummary(Report testLinkReport, Report previous) {
 		StringBuilder builder = new StringBuilder();
 		builder.append("<p><b>"+Messages.ReportSummary_Summary_BuildID(testLinkReport.getBuildId())+"</b></p>");
-		builder.append("<p><b>"+Messages.ReportSummary_Summary_BuildName(testLinkReport.getBuildName())+"</b></p>");
+		builder.append("<p><b>"+Messages.ReportSummary_Summary_BuildName(Util.escape(testLinkReport.getBuildName()))+"</b></p>");
 		builder.append("<p><a href=\"" + TestLinkBuildAction.URL_NAME + "\">");
 
 		Integer total = testLinkReport.getTestsTotal();
@@ -395,11 +395,11 @@ public static String createReportSummaryDetails(Report report, Report previous)
         for(TestCaseWrapper tc: report.getTestCases() )
         {
         	builder.append("<tr>\n");
-        	
+
         	builder.append("<td>"+tc.getId()+"</td>");
-        	builder.append("<td>"+tc.getFullExternalId()+"</td>");
+        	builder.append("<td>"+Util.escape(tc.getFullExternalId())+"</td>");
         	builder.append("<td>"+tc.getVersion()+"</td>");
-        	builder.append("<td>"+tc.getName()+"</td>");
+        	builder.append("<td>"+Util.escape(tc.getName())+"</td>");
         	builder.append("<td>"+tc.getTestProjectId()+"</td>");
     		builder.append("<td>"+TestLinkHelper.getExecutionStatusTextColored( tc.getExecutionStatus() )+"</td>\n");
 
@@ -410,8 +410,6 @@ public static String createReportSummaryDetails(Report report, Report previous)
         return builder.toString();
 	}
 
-
-
 	/**
 	 * Prints the difference between two int values, showing a plus sign if the 
 	 * current number is greater than the previous. 

diff --git a/src/main/resources/hudson/plugins/testlink/TestLinkBuildAction/summary.jelly b/src/main/resources/hudson/plugins/testlink/TestLinkBuildAction/summary.jelly
@@ -6,7 +6,7 @@
 	xmlns:f="/lib/form"
     xmlns:i="jelly:fmt">
     <t:summary icon="/plugin/testlink/icons/testlink-48.png">
-		${it.summary}
-		${it.details}
+			<j:out value="${it.summary}"/>
+			<j:out value="${it.details}"/>
 	</t:summary>
 </j:jelly>