[FIXED JENKINS-43380] escape HTML and then display it

jenkinsci · Jul 6, 2017 · 978eac9 · 978eac9
1 parent a5f0512
commit 978eac9
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/main/resources/org/biouno/unochoice/common/choiceParameterCommon.jelly b/src/main/resources/org/biouno/unochoice/common/choiceParameterCommon.jelly
@@ -1,12 +1,14 @@
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
   xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
   xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">
   <st:adjunct includes="org.kohsuke.stapler.jquery"/>
   <st:adjunct includes="org.biouno.unochoice.stapler.unochoice"/>
   <j:set var="paramName" value="${it.randomName}" scope="parent" />
   <j:set var="choiceType" value="${it.choiceType}"/>
+  <j:set var="escapeEntryTitleAndDescription" value="false"/>
   <f:entry title="${it.name}" description="${it.description}">
-    <div name="parameter" description="${it.description}" id='${paramName}'>
+    <div name="parameter" description="${h.escape(it.description)}" id='${paramName}'>
       <input type="hidden" name="name" value="${it.name}" />
       <j:choose>
         <j:when test="${choiceType eq 'PT_SINGLE_SELECT'}">