• Type: Bug
• Resolution: Unresolved
• Priority: Major
• Component/s: summary_report-plugin
• Labels:

  • HTML
  • reporting
• Environment:

  Jenkins v 2.187 Summary Display Plugin v1.15

1. actions.xml

   3 kB

   2019-08-22 16:02

2. 

   image-2019-08-22-11-56-28-540.png

   73 kB

   2019-08-22 15:56

3. 

   image-2019-08-22-11-56-59-572.png

   99 kB

   2019-08-22 15:57

[JENKINS-59056] Report displays raw HTML if CDATA terms are used

Collapse comment: Ioannis Moutsatsos added a comment - 2019-08-23 19:51, Edited by Ioannis Moutsatsos - 2019-08-23 20:21

Ioannis Moutsatsos added a comment - 2019-08-23 19:51 - edited

After some investigation and head-banging I came across what seems to be the exact cause of this bug: https://wiki.jenkins.io/display/JENKINS/Plugins+affected+by+2018-10-10+Stapler+security+hardening The Summary Display Plugin is specifically listed and the 'impact/behavior' is listed as 'Raw HTML is shown if CDATA terms are used'

 

They also claim that 'We expect that (affected) plugins will adapt pretty quickly to this change, as the fix is typically straightforward.'

Finally a workaround is offered, which I'm using until the plugin is fixed. See https://jenkins.io/doc/upgrade-guide/2.138/#security-hardening-to-prevent-xss-vulnerabilities

Expand comment: Ioannis Moutsatsos added a comment - 2019-08-23 19:51, Edited by Ioannis Moutsatsos - 2019-08-23 20:21

Ioannis Moutsatsos added a comment - 2019-08-23 19:51 - edited After some investigation and head-banging I came across what seems to be the exact cause of this bug: https://wiki.jenkins.io/display/JENKINS/Plugins+affected+by+2018-10-10+Stapler+security+hardening  The Summary Display Plugin is specifically listed and the 'impact/behavior' is listed as 'Raw HTML is shown if CDATA terms are used'   They also claim that 'We expect that (affected) plugins will adapt pretty quickly to this change, as the fix is typically straightforward.' Finally a workaround is offered, which I'm using until the plugin is fixed. See  https://jenkins.io/doc/upgrade-guide/2.138/#security-hardening-to-prevent-xss-vulnerabilities

Collapse comment: Adam Olejar added a comment - 2020-01-18 13:34

Adam Olejar added a comment - 2020-01-18 13:34

How did you set org.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault to false ? I Cant find that setting.

 

Expand comment: Adam Olejar added a comment - 2020-01-18 13:34

Adam Olejar added a comment - 2020-01-18 13:34 How did you set org.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault to false ? I Cant find that setting.  

Collapse comment: Ioannis Moutsatsos added a comment - 2020-04-17 16:11

Ioannis Moutsatsos added a comment - 2020-04-17 16:11

olejara you can apply the setting at the command used to startup Jenkins. This is what my command line looks like:

java -Xrs -Xmx2048m -XX:MaxPermSize=512m -Dhudson.model.DirectoryBrowserSupport.CSP= -Dorg.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault="false" -Dhudson.lifecycle=hudson.lifecycle.WindowsServiceLifecycle -jar "path/to/jenkins/jenkins.war" --httpPort=8080

Expand comment: Ioannis Moutsatsos added a comment - 2020-04-17 16:11

Ioannis Moutsatsos added a comment - 2020-04-17 16:11 olejara you can apply the setting at the command used to startup Jenkins. This is what my command line looks like: java -Xrs -Xmx2048m -XX:MaxPermSize=512m -Dhudson.model.DirectoryBrowserSupport.CSP= -Dorg.kohsuke.stapler.jelly.CustomJellyContext.escapeByDefault="false" -Dhudson.lifecycle=hudson.lifecycle.WindowsServiceLifecycle -jar "path/to/jenkins/jenkins.war" --httpPort=8080