[JIRA] (JENKINS-55790) Enable opt-out of RawHtmlMarkupFormatter processing

tskrainar@icloud.com (JIRA)

unread,

Jan 25, 2019, 7:57:02 PM1/25/19

to jenkinsc...@googlegroups.com

Tom Skrainar created an issue

Jenkins /

JENKINS-55790

Enable opt-out of RawHtmlMarkupFormatter processing

Issue Type:	Improvement
Assignee:	Marc Brugger
Components:	badge-plugin
Created:	2019-01-26 00:56
Environment:	badge-plugin 1.5 and newer
Priority:	Minor
Reporter:	Tom Skrainar

Commit 63a7744cef33338e62898576a50bcc521d76ba9f (in support of SECURITY-906) filters text passed to BadgeSummaryAction.appendText() through a RawHtmlMarkupFormatter, which prevents arbitrary URI schemes being rendered as hrefs (only http/mailto seem to be supported).

I appreciate the intent behind this change, but for people who rely on being able to provide hyperlinked text to arbitrary URI schemes, it would be really useful to explicitly disable this (resulting in a call to getRawHtml() instead).

The current implementation is a (very) reasonable default, but I would like the ability to explicitly select "give me the unsanitized HTML".