[JIRA] [git-plugin] (JENKINS-29075) List of changes escapes HTML output of jira-plugin

瀏覽次數：2 次
跳到第一則未讀訊息

carsten.pfeiffer@gebit.de (JIRA)

未讀,
2015年6月25日 凌晨2:54:012015/6/25
收件者：jenkinsc...@googlegroups.com
Carsten Pfeiffer created an issue
 
Jenkins / Bug JENKINS-29075
List of changes escapes HTML output of jira-plugin
Issue Type: Bug Bug
Assignee: Nicolas De Loof
Attachments: html-escaped.png
Components: git-plugin, jira-plugin
Created: 25/Jun/15 6:53 AM
Environment: Linux, Jira 4.1.x, Jenkins 1.616, jira-plugin 1.41, git-plugin 2.3.5
Priority: Minor Minor
Reporter: Carsten Pfeiffer

We're using the jira-plugin to link git-commits to jira issues. Recently the "Changes" box does not properly display the referenced Jira issues as html-links anymore. It escapes the HTML generated by jira-plugin like this:

HTML-escaping the git commit message is probably a good idea, but there should be a way for the jira-plugin to create properly displayed links to the referenced Jira issues.
Add Comment Add Comment
 
This message was sent by Atlassian JIRA (v6.4.2#64017-sha1:e244265)
Atlassian logo

mark.earl.waite@gmail.com (JIRA)

未讀,
2015年6月25日 晚上11:36:022015/6/25
收件者：jenkinsc...@googlegroups.com
Mark Waite commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

Any chance you changed the global settings for security, specifically those related to the handling of HTML embedded in content?

Alternately, did you recently upgrade from an older version of the git plugin or the git client plugin?

A security fix was applied to git plugin 2.3.4 to prevent malicious code from being inserted into the Jenkins pages through a commit message to the git repository. That might have affected what you are seeing.

carsten.pfeiffer@gebit.de (JIRA)

未讀,
2015年6月26日 凌晨4:19:012015/6/26
收件者：jenkinsc...@googlegroups.com

Thanks for you quick response, Mark.

We didn't change the security settings – the current value for the markup formatter is "Safe HTML". The other available value is "Escaped HTML". I just changed the setting to Escaped HTML once and back to Safe HTML again to rule out a weird configuration bug, but I doubt that this is the reason.

I guess it's rather the security fix for the git plugin "Escape HTML generated into jelly pages with escape="true". The last version without this fix is 2.3.2; I'll see if I can install it to verify this.

It would be nice if the escaping could be done at a different level, i.e. before the jira-plugin has processed the message, or if it would use the "Safe HTML" formatter that would only remove potentially malicious tags like <script>.

mark.earl.waite@gmail.com (JIRA)

未讀,
2015年6月26日 清晨7:42:012015/6/26
收件者：jenkinsc...@googlegroups.com

Carsten Pfeiffer I'm not sure what changed that caused the behavior to be visible now when it was not visible before. Did you recently update your git plugin to the most recent release?

carsten.pfeiffer@gebit.de (JIRA)

未讀,
2015年6月26日 上午8:03:022015/6/26
收件者：jenkinsc...@googlegroups.com

Yes, I did recently update. And I can confirm that git-plugin 2.3.2 produces correct HTML output. So the change "Escape HTML generated into jelly pages with escape="true"" is mostly likely the cause for this.

carsten.pfeiffer@gebit.de (JIRA)

未讀,
2015年6月26日 上午8:19:012015/6/26
收件者：jenkinsc...@googlegroups.com

It looks like I was a bit too quick.

  • When I click on "Changes", I get a page "Changes from Git" with a summary table. That one is OK, i.e. the links to Jira issues are good.
  • The page of an individual build that also lists the changes still shows escaped HTML, even with 2.3.2. I tested this with a fresh build, so I can't display information recorded with the previous (newer) git plugin.

radek.antoniuk@quiddia.com (JIRA)

未讀,
2015年9月7日 晚上7:22:012015/9/7
收件者：jenkinsc...@googlegroups.com
Radek Antoniuk assigned an issue to Radek Antoniuk
 
Change By: Radek Antoniuk
Assignee: Nicolas De Loof Radek Antoniuk

radek.antoniuk@quiddia.com (JIRA)

未讀,
2015年9月30日 晚上7:49:022015/9/30
收件者：jenkinsc...@googlegroups.com
Radek Antoniuk commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

I've just tested with Jenkins 1.609.3, git-plugin 2.4.0, jira-plugin 2.0.2 and it works for me. Also tried downgrading the plugins, still was unable to replicate. To note, I don't have "Safe HTML" option, AFAIR this is an old naming, now I have "Escaped HTML" and "Raw HTML".

carsten.pfeiffer@gebit.de (JIRA)

未讀,
2015年10月1日 凌晨2:57:042015/10/1
收件者：jenkinsc...@googlegroups.com

Thanks for trying it. I upgraded to latest Jenkins (1.631) and git-plugin 2.4.0. I had to keep the jira-plugin at 1.41, because this jira doesn't have the REST API.
The "git changes" block of individual builds still shows HTML code as before.

I checked the "Safe HTML" option in Global Security settings. I only have the options "Safe HTML" and "Plain text" (Jenkins with German translation). Changing to "Plain text" doesn't help, the result is still HTML code.

Any other idea where this might come from?

radek.antoniuk@quiddia.com (JIRA)

未讀,
2015年10月1日 清晨5:41:012015/10/1
收件者：jenkinsc...@googlegroups.com

I have now tested with JIRA 6.3.0, jira-plugin 1.41, git-plugin 2.3.5 and 2.4.0, tried switching Raw/Escaped HTML and always worked fine for me. I made a screenshot with what I can see, it looks a bit different but that might be the new UI. Not sure why you still see "Safe HTML" and "Plain text"..

radek.antoniuk@quiddia.com (JIRA)

未讀,
2015年10月1日 清晨5:42:022015/10/1
收件者：jenkinsc...@googlegroups.com
Radek Antoniuk updated an issue
 

My testing.
Change By: Radek Antoniuk
Attachment: j.png

carsten.pfeiffer@gebit.de (JIRA)

未讀,
2015年10月1日 上午8:23:012015/10/1
收件者：jenkinsc...@googlegroups.com

radek.antoniuk@quiddia.com (JIRA)

未讀,
2015年10月1日 上午8:42:012015/10/1
收件者：jenkinsc...@googlegroups.com

Can you try disabling some of them to see if it fixes it?

carsten.pfeiffer@gebit.de (JIRA)

未讀,
2015年10月1日 上午8:53:032015/10/1
收件者：jenkinsc...@googlegroups.com

Yes, will do, but cannot do it today anymore.

carsten.pfeiffer@gebit.de (JIRA)

未讀,
2015年10月2日 上午9:00:092015/10/2
收件者：jenkinsc...@googlegroups.com

FWIW, in a first test, I couldn't reproduce the problem on a new test machine. I'll dig some more to find out the cause.

radek.antoniuk@quiddia.com (JIRA)

未讀,
2015年10月26日 上午11:18:012015/10/26
收件者：jenkinsc...@googlegroups.com
Radek Antoniuk resolved as Incomplete
 

I'm closing it for now, feel free to reopen if you find anything interesting.
Change By: Radek Antoniuk
Status: Open Resolved
Resolution: Incomplete

ferruccio.bongianni@gmail.com (JIRA)

未讀,
2016年6月27日 清晨5:14:022016/6/27
收件者：jenkinsc...@googlegroups.com
ferruccio bongianni commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

Hello,
I've got the same problem; has it been tackled / resolved?
Thanks
Ferruccio
This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c)
Atlassian logo

medianick@gmail.com (JIRA)

未讀,
2016年6月28日 上午11:09:012016/6/28
收件者：jenkinsc...@googlegroups.com

Same issue here. Jenkins 1.651.3 LTS, Git Client plugin 1.19.6, Git plugin 2.5.0, JIRA plugin 2.2.1, JIRA Plugin for Jenkins (from Marvelution) 1.5.5, Subversion plugin 2.6.

The Recent Changes link for the job (listing recent builds and their changes, at /job/

{job name}/changes) shows the JIRA links properly (unescaped), but the changes shown on the main page for each build (at /job/{job name}

/

{build number}

) shows the escaped URLs.

medianick@gmail.com (JIRA)

未讀,
2016年6月28日 上午11:10:032016/6/28
收件者：jenkinsc...@googlegroups.com
Nick Jones reopened an issue
 
Change By: Nick Jones
Resolution: Incomplete
Status: Resolved Reopened

medianick@gmail.com (JIRA)

未讀,
2016年6月28日 上午11:11:022016/6/28
收件者：jenkinsc...@googlegroups.com
Nick Jones edited a comment on Bug JENKINS-29075
Same issue here. Jenkins 1.651.3 LTS, Git Client plugin 1.19.6, Git plugin 2.5.0, JIRA plugin 2.2.1, JIRA Plugin for Jenkins (from Marvelution) 1.5.5, Subversion plugin 2.6.

The Recent Changes link for the job (listing recent builds and their changes, at /job/ {job name} _name_ /changes) shows the JIRA links properly (unescaped), but the changes shown on the main page for each build (at /job/ {job name} _name_ / {build number} _id_ ) shows the escaped URLs.

jbb.ve@free.fr (JIRA)

未讀,
2016年8月18日 凌晨3:45:012016/8/18
收件者：jenkinsc...@googlegroups.com
Sébastien Sébastien updated an issue
 
Change By: Sébastien Sébastien
Attachment: ok.png

jbb.ve@free.fr (JIRA)

未讀,
2016年8月18日 凌晨3:46:012016/8/18
收件者：jenkinsc...@googlegroups.com
Sébastien Sébastien commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

I got the same problem with
Jenkins ver. 2.7.2
JIRA plugin 2.2.1

Unable to render embedded object: File (nok.png) not found.

jbb.ve@free.fr (JIRA)

未讀,
2016年8月18日 凌晨3:47:012016/8/18
收件者：jenkinsc...@googlegroups.com
Sébastien Sébastien updated an issue
Change By: Sébastien Sébastien
Attachment: nok.png

jbb.ve@free.fr (JIRA)

未讀,
2016年8月18日 凌晨3:48:012016/8/18
收件者：jenkinsc...@googlegroups.com
I got the same problem with
* Jenkins ver. 2.7.2
 * JIRA plugin 2.2.1
!ok.png|thumbnail!
!nok.png|thumbnail!

andrei@k-tz.com (JIRA)

未讀,
2016年9月26日 下午3:40:012016/9/26
收件者：jenkinsc...@googlegroups.com
Andrei Barychev updated an issue
 
Change By: Andrei Barychev
Attachment: JIRA-5.4-vs-JIRA-6.2.png

andrei@k-tz.com (JIRA)

未讀,
2016年9月26日 下午3:41:012016/9/26
收件者：jenkinsc...@googlegroups.com
Andrei Barychev commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

I'm having this problem for a couple of months. My case may be helpful for the plugin developers though.

I have two JIRA servers. The first is running JIRA 5.4, with both SOAP and REST APIs enabled. The other is running JIRA 6.2, with REST API only.

I never had a problem with Jenkins displaying issues' details for projects hosted in JIRA 5.4 projects. However, Jenkins displays the escaped HTML for the issues in projects hosted by JIRA 6.2.

Please note, that the escaped HTML is displayed only on Build Status and Build Changes pages. The same issues are displayed correctly on the Project Changes page.

andrei@k-tz.com (JIRA)

未讀,
2016年9月26日 下午3:42:022016/9/26
收件者：jenkinsc...@googlegroups.com
Andrei Barychev edited a comment on Bug JENKINS-29075
I'm having this problem for a couple of months. My case may be helpful for the plugin developers though.

I have *two* JIRA servers. The first is running JIRA 5.4, with both SOAP and REST APIs enabled. The other is running JIRA 6.2, with REST API only.

I never had a problem with Jenkins displaying issues' details for projects hosted in by JIRA 5.4 projects . However, Jenkins displays the escaped HTML for the issues in projects hosted by JIRA 6.2.

Please note, that the {color:red}escaped HTML is displayed{color} only on *Build Status* and *Build Changes* pages. The {color:#14892c}same issues are displayed correctly{color} on the *Project Changes* page.

!JIRA-5.4-vs-JIRA-6.2.png|thumbnail!

andrei@k-tz.com (JIRA)

未讀,
2016年9月26日 下午3:58:022016/9/26
收件者：jenkinsc...@googlegroups.com
Andrei Barychev edited a comment on Bug JENKINS-29075
{color:#d04437}*Please disregard the below comment. I was totally wrong. After switching the Jenkins projects to the other JIRA, the 5.4 issues also appear in escaped HTML. My bad.*{color}

I 'm having this problem for a couple of months. My case may be helpful for the plugin developers though.


I have *two* JIRA servers. The first is running JIRA 5.4, with both SOAP and REST APIs enabled. The other is running JIRA 6.2, with REST API only.

I never had a problem with Jenkins displaying issues' details for projects hosted by JIRA 5.4. However, Jenkins displays the escaped HTML for the issues in projects hosted by JIRA 6.2.


Please note, that the {color:red}escaped HTML is displayed{color} only on *Build Status* and *Build Changes* pages. The {color:#14892c}same issues are displayed correctly{color} on the *Project Changes* page.

!JIRA-5.4-vs-JIRA-6.2.png|thumbnail!

carsten.pfeiffer@gebit.de (JIRA)

未讀,
2016年9月27日 凌晨3:48:032016/9/27
收件者：jenkinsc...@googlegroups.com

I just checked again and in our setup, this bug is gone:
jenkins 2.8
git-plugin 2.4.4

jdavis@ipswitch.com (JIRA)

未讀,
2016年10月15日 下午4:04:042016/10/15
收件者：jenkinsc...@googlegroups.com
Jason Davis updated an issue
 
Change By: Jason Davis
Attachment: p4-changes.png

jdavis@ipswitch.com (JIRA)

未讀,
2016年10月15日 下午4:06:012016/10/15
收件者：jenkinsc...@googlegroups.com
Jason Davis commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

I've noticed this issue with the P4 plugin. The overall project changes list is OK, but the change report for a single build is still showing the html for the link instead of actually showing the link.

jdavis@ipswitch.com (JIRA)

未讀,
2016年10月15日 下午4:07:032016/10/15
收件者：jenkinsc...@googlegroups.com
Jason Davis edited a comment on Bug JENKINS-29075
I've noticed this issue with the P4 plugin.  The overall project changes list is OK, but the change report for a single build is still showing the html for the link instead of actually showing the link.  

!p4-changes.png|thumbnail!

jenkins 2.25, JIRA plugin 2.2.1, p4 plugin 1.4.8

radek.antoniuk@quiddia.com (JIRA)

未讀,
2016年10月16日 下午5:54:022016/10/16
收件者：jenkinsc...@googlegroups.com
Radek Antoniuk resolved as Cannot Reproduce
 

Jason, do you mind opening a new issue for P4 as this issue was concerning git integration and it seems is currently resolved. Thanks!
Change By: Radek Antoniuk
Status: Reopened Resolved
Resolution: Cannot Reproduce

ljaderdev@gmail.com (JIRA)

未讀,
2016年11月5日 下午6:13:022016/11/5
收件者：jenkinsc...@googlegroups.com
Łukasz Jąder commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

This issue should be fixed in git-plugin since 2.3.4 - by commit:
https://github.com/jenkinsci/git-plugin/commit/930ac05035e5292dbdeea4f2135881a0d3f03060

Sébastien DK your job uses SVN, and subversion-plugin still needs the fix to be applied:
https://github.com/jenkinsci/subversion-plugin/pull/174

Probably other SCM like Perforce, or "SCM combining" plugins should be analyzed, if they are also affected.

Hope that helps.

ben.herfurth@develop-group.de (JIRA)

未讀,
2017年1月17日 凌晨3:43:022017/1/17
收件者：jenkinsc...@googlegroups.com

When will the fix for svn be released?

ben.herfurth@develop-group.de (JIRA)

未讀,
2017年1月17日 凌晨3:43:042017/1/17
收件者：jenkinsc...@googlegroups.com
Ben Herfurth edited a comment on Bug JENKINS-29075
When will the fix for the svn plugin be released?

mark.earl.waite@gmail.com (JIRA)

未讀,
2017年1月17日 清晨6:16:022017/1/17
收件者：jenkinsc...@googlegroups.com

Conversations on subversion plugin PR174 with Daniel Beck and Oleg Nenashev indicate that the change has been approved but not yet merged.

mark.earl.waite@gmail.com (JIRA)

未讀,
2017年1月17日 清晨6:16:052017/1/17
收件者：jenkinsc...@googlegroups.com
Mark Waite updated an issue
 
Change By: Mark Waite
Component/s: subversion-plugin

ben.herfurth@develop-group.de (JIRA)

未讀,
2017年1月17日 清晨6:25:012017/1/17
收件者：jenkinsc...@googlegroups.com
Ben Herfurth commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

ok. thank you for the information!

Did not find them by myself :<

mark.earl.waite@gmail.com (JIRA)

未讀,
2019年10月22日 晚上9:32:422019/10/22
收件者：jenkinsc...@googlegroups.com
Mark Waite closed an issue as Cannot Reproduce
 
Change By: Mark Waite
Status: Resolved Closed
This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)
Atlassian logo
回覆所有人
回覆作者
轉寄
0 則新訊息