Details
-
Bug
-
Status: Closed (View Workflow)
-
Minor
-
Resolution: Fixed
-
None
-
Jenkins 2.219
Active Choices (uno-choice) v2.0
OWASP Markup Formatter Plugin (antisamy-markup-formatter-plugin) v1.8/v2.0
Description
With Active Choices and OWASP Markup Formatter Plugin v2.0 installed, "input" elements are being stripped from "Formatted HTML" parameters. This is not an issue with OWASP Markup Formatter Plugin v1.8. Since this is one of the main use-cases of the Active Choices plugin, I assume this is a bug. There also doesn't seem to be a way to configure the markup formatter that the Active Choices plugin uses.
Attached are screenshots of the parameter config, the working "input" field with v1.8, and the missing input field with v2.0.
kinow can you try running the following in your script console?
That gives the following result on my test instance:
And when I downgrade the plugins:
Markup Formatter Version: 1.8 Formatted: '<input type="text" name="value" value="bar">'
AFAICT it looks like formatting with RawHtmlMarkupFormatter is unavoidable when using the groovy sandbox, per this line: https://github.com/biouno/uno-choice-plugin/blob/master/src/main/java/org/biouno/unochoice/model/GroovyScript.java#L174