Culprit:

• GitPublisher/config.jelly#L24
• GitPublisher/config.jelly#L39
• GitPublisher/config.jelly#L54
• GitPublisher/config.jelly#L59
• GitPublisher/config.jelly#L76

Reproduction steps:

• Install Git or clone https://github.com/jenkinsci/git-plugin and then mvn hpi:run
• Create a freestyle project
• Add a "Git Publisher" post-build step
• Click on "Add Tag" or "Add Branch" or "Add Note" (all three are affected)
• When adding content to their field you should send a POST request with your input as an argument

Screenshot attached about where the feature is displayed.

Proposal
https://www.jenkins.io/doc/developer/security/csp/#legacy-javascript-checkurl-validation

Testing notes

• Ensure to reproduce the feature before any change
• Ensure that you reproduce the feature after you have made the change