• Type: Bug
• Resolution: Unresolved
• Priority: Minor
• Component/s: upstream-downstream-view-plugin
• Labels:

  None
• Environment:

  Jenkins 2.138.2

[JENKINS-54124] Raw HTML when Stapler Security Hardening enabled

Yura Kovalenko created issue - 2018-10-17 11:13

Yura Kovalenko made changes - 2018-10-17 11:13

Description

Original: After upgrading to 2.138.2 all the links in columns are shown in raw HTML. As noted [here|https://jenkins.io/doc/upgrade-guide/2.138/#security-hardening-to-prevent-xss-vulnerabilities], setting the system property org.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault to false helps.

New: After upgrading to 2.138.2 all links in columns are shown in raw HTML. As noted [here|https://jenkins.io/doc/upgrade-guide/2.138/#security-hardening-to-prevent-xss-vulnerabilities], setting the system property org.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault to false helps.

Yura Kovalenko made changes - 2018-10-17 11:25

Description

Original: After upgrading to 2.138.2 all links in columns are shown in raw HTML. As noted [here|https://jenkins.io/doc/upgrade-guide/2.138/#security-hardening-to-prevent-xss-vulnerabilities], setting the system property org.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault to false helps.

New: After upgrading to 2.138.2 all links in columns are shown in raw HTML.  Looks like setting system property org.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault to false as noted [here|https://jenkins.io/doc/upgrade-guide/2.138/#security-hardening-to-prevent-xss-vulnerabilities] doesn't help.

Yura Kovalenko made changes - 2018-10-17 14:45

Description

Original: After upgrading to 2.138.2 all links in columns are shown in raw HTML.  Looks like setting system property org.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault to false as noted [here|https://jenkins.io/doc/upgrade-guide/2.138/#security-hardening-to-prevent-xss-vulnerabilities] doesn't help.

New: After upgrading to 2.138.2 all links in columns are shown in raw HTML.  -Looks like setting system property org.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault to false as noted [here|https://jenkins.io/doc/upgrade-guide/2.138/#security-hardening-to-prevent-xss-vulnerabilities] doesn't help.- Setting org.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault to false helps.