Culprit:

• (1) GitTagAction/tagForm.jelly#L84 event-handlers
• (2) GitTagAction/tagForm.jelly#L105-L111 javascript-blocks

Reproduction steps:

• Install Git or clone https://github.com/jenkinsci/git-plugin and then mvn hpi:run
• Go to Manage Jenkins > Configure System
• Scroll down to the "Git plugin" section
• Check "Add git tag action to jobs"
• Save
• Create a freestyle project
• Scroll down to the "Source Code Management" section
• Check "Git"
• In the Repository URL add the following repo:

  https://github.com/Kevin-CB/RandomRepo.git
  

• In the "Branch Specifier (blank for 'any')" field add the following string:

  refs/tags/Tag1
  

• Click on "Add Branch"
• In the new "Branch Specifier (blank for 'any')" field add the following string:

  refs/tags/Tag2
  

• Save
• Build your job
• Go to your build
• Click on "No Tags" on the side-panel

Screenshot attached about where the feature is displayed.

Proposal

• https://www.jenkins.io/doc/developer/security/csp/#inline-event-handlers
• https://www.jenkins.io/doc/developer/security/csp/#inline-javascript-blocks

Testing notes

• Ensure to reproduce the feature before any change
• Ensure that you reproduce the feature after you have made the change