As you can see Jenkins already does double escaping when job publishes it's Checkstyle.xml report (the <message> node in jenkins_checkstyle.xml). If that will be fixed, then I guess all should be ok.

However if API xml request doesn't escape content considering that published checkstyle xml file already was escaped then this might be problematic.

Code changed in jenkins
User: Ulli Hafner
Path:
.idea/libraries/Maven__org_jvnet_hudson_plugins_analysis_core_1_66.xml
analysis-collector
checkstyle
compile.sh
warnings
http://jenkins-ci.org/commit/analysis-suite-plugin/479368313b7a76b448f13dcf4cc9dce8fcd51a9d
Log:
[FIXED JENKINS-25511] JENKINS-17309 Reverted XML escaping of message.

Revert of fix for JENKINS-17309. Previous solution was too aggressive, it makes sense to escape only messages from parsers that parse non-XML files. XML parsers should not escape entities at all.
AbstractAnnotation never escapes entities now, only GCC parser escapes and invokes constructor with escaped message.

Compare: https://github.com/jenkinsci/analysis-suite-plugin/compare/db92e5d8fbfa...479368313b7a

Code changed in jenkins
User: Ulli Hafner
Path:
checkstyle.iml
pom.xml
src/test/java/hudson/plugins/checkstyle/parser/CheckStyleParserTest.java
http://jenkins-ci.org/commit/checkstyle-plugin/067654f75120c548ba24ddf20b574e00e1c5056b
Log:
[FIXED JENKINS-25511] JENKINS-17309 Reverted XML escaping of message.

Revert of fix for JENKINS-17309. Previous solution was too aggressive, it makes sense to escape only messages from parsers that parse non-XML files. XML parsers should not escape entities at all.
AbstractAnnotation never escapes entities now, only GCC parser escapes and invokes constructor with escaped message.

Code changed in jenkins
User: Ulli Hafner
Path:
src/main/java/hudson/plugins/analysis/util/AbstractPackageDetector.java
src/main/java/hudson/plugins/analysis/util/EncodingValidator.java
src/main/java/hudson/plugins/analysis/util/JavaPackageDetector.java
src/main/java/hudson/plugins/analysis/util/model/AbstractAnnotation.java
src/test/java/hudson/plugins/analysis/util/model/AbstractAnnotationTest.java
http://jenkins-ci.org/commit/analysis-core-plugin/e001040655c1b7018019a3179ed346b9f855c438
Log:
[FIXED JENKINS-25511] JENKINS-17309 Reverted XML escaping of message.

Revert of fix for JENKINS-17309. Previous solution was too aggressive, it makes sense to escape only messages from parsers that parse non-XML files. XML parsers should not escape entities at all.
AbstractAnnotation never escapes entities now, only GCC parser escapes and invokes constructor with escaped message.

Compare: https://github.com/jenkinsci/analysis-core-plugin/compare/4b695e192cc2...e001040655c1

Code changed in jenkins
User: Ulli Hafner
Path:
pom.xml
src/main/java/hudson/plugins/warnings/parser/AbstractWarningsParser.java
src/main/java/hudson/plugins/warnings/parser/GccParser.java
src/test/java/hudson/plugins/warnings/parser/GccParserTest.java
src/test/java/hudson/plugins/warnings/parser/ParserTester.java
src/test/resources/hudson/plugins/warnings/parser/issue17309.txt
warnings.iml
http://jenkins-ci.org/commit/warnings-plugin/7af227eb669868a09d1fe09e19c8a025118983dc
Log:
[FIXED JENKINS-25511] JENKINS-17309 Reverted XML escaping of message.

Revert of fix for JENKINS-17309. Previous solution was too aggressive, it makes sense to escape only messages from parsers that parse non-XML files. XML parsers should not escape entities at all.
AbstractAnnotation never escapes entities now, only GCC parser escapes and invokes constructor with escaped message.

Compare: https://github.com/jenkinsci/warnings-plugin/compare/a811a92cfee0...7af227eb6698