[JIRA] [git-plugin] (JENKINS-29075) List of changes escapes HTML output of jira-plugin

2 views
Skip to first unread message

carsten.pfeiffer@gebit.de (JIRA)

unread,
Jun 25, 2015, 2:54:01 AM6/25/15
to jenkinsc...@googlegroups.com
Carsten Pfeiffer created an issue
 
Jenkins / Bug JENKINS-29075
List of changes escapes HTML output of jira-plugin
Issue Type: Bug Bug
Assignee: Nicolas De Loof
Attachments: html-escaped.png
Components: git-plugin, jira-plugin
Created: 25/Jun/15 6:53 AM
Environment: Linux, Jira 4.1.x, Jenkins 1.616, jira-plugin 1.41, git-plugin 2.3.5
Priority: Minor Minor
Reporter: Carsten Pfeiffer

We're using the jira-plugin to link git-commits to jira issues. Recently the "Changes" box does not properly display the referenced Jira issues as html-links anymore. It escapes the HTML generated by jira-plugin like this:

HTML-escaping the git commit message is probably a good idea, but there should be a way for the jira-plugin to create properly displayed links to the referenced Jira issues.
Add Comment Add Comment
 
This message was sent by Atlassian JIRA (v6.4.2#64017-sha1:e244265)
Atlassian logo

mark.earl.waite@gmail.com (JIRA)

unread,
Jun 25, 2015, 11:36:02 PM6/25/15
to jenkinsc...@googlegroups.com
Mark Waite commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

Any chance you changed the global settings for security, specifically those related to the handling of HTML embedded in content?

Alternately, did you recently upgrade from an older version of the git plugin or the git client plugin?

A security fix was applied to git plugin 2.3.4 to prevent malicious code from being inserted into the Jenkins pages through a commit message to the git repository. That might have affected what you are seeing.

carsten.pfeiffer@gebit.de (JIRA)

unread,
Jun 26, 2015, 4:19:01 AM6/26/15
to jenkinsc...@googlegroups.com

Thanks for you quick response, Mark.

We didn't change the security settings – the current value for the markup formatter is "Safe HTML". The other available value is "Escaped HTML". I just changed the setting to Escaped HTML once and back to Safe HTML again to rule out a weird configuration bug, but I doubt that this is the reason.

I guess it's rather the security fix for the git plugin "Escape HTML generated into jelly pages with escape="true". The last version without this fix is 2.3.2; I'll see if I can install it to verify this.

It would be nice if the escaping could be done at a different level, i.e. before the jira-plugin has processed the message, or if it would use the "Safe HTML" formatter that would only remove potentially malicious tags like <script>.

mark.earl.waite@gmail.com (JIRA)

unread,
Jun 26, 2015, 7:42:01 AM6/26/15
to jenkinsc...@googlegroups.com

Carsten Pfeiffer I'm not sure what changed that caused the behavior to be visible now when it was not visible before. Did you recently update your git plugin to the most recent release?

carsten.pfeiffer@gebit.de (JIRA)

unread,
Jun 26, 2015, 8:03:02 AM6/26/15
to jenkinsc...@googlegroups.com

Yes, I did recently update. And I can confirm that git-plugin 2.3.2 produces correct HTML output. So the change "Escape HTML generated into jelly pages with escape="true"" is mostly likely the cause for this.

carsten.pfeiffer@gebit.de (JIRA)

unread,
Jun 26, 2015, 8:19:01 AM6/26/15
to jenkinsc...@googlegroups.com

It looks like I was a bit too quick.

  • When I click on "Changes", I get a page "Changes from Git" with a summary table. That one is OK, i.e. the links to Jira issues are good.
  • The page of an individual build that also lists the changes still shows escaped HTML, even with 2.3.2. I tested this with a fresh build, so I can't display information recorded with the previous (newer) git plugin.

radek.antoniuk@quiddia.com (JIRA)

unread,
Sep 7, 2015, 7:22:01 PM9/7/15
to jenkinsc...@googlegroups.com
Radek Antoniuk assigned an issue to Radek Antoniuk
 
Change By: Radek Antoniuk
Assignee: Nicolas De Loof Radek Antoniuk

radek.antoniuk@quiddia.com (JIRA)

unread,
Sep 30, 2015, 7:49:02 PM9/30/15
to jenkinsc...@googlegroups.com
Radek Antoniuk commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

I've just tested with Jenkins 1.609.3, git-plugin 2.4.0, jira-plugin 2.0.2 and it works for me. Also tried downgrading the plugins, still was unable to replicate. To note, I don't have "Safe HTML" option, AFAIR this is an old naming, now I have "Escaped HTML" and "Raw HTML".

carsten.pfeiffer@gebit.de (JIRA)

unread,
Oct 1, 2015, 2:57:04 AM10/1/15
to jenkinsc...@googlegroups.com

Thanks for trying it. I upgraded to latest Jenkins (1.631) and git-plugin 2.4.0. I had to keep the jira-plugin at 1.41, because this jira doesn't have the REST API.
The "git changes" block of individual builds still shows HTML code as before.

I checked the "Safe HTML" option in Global Security settings. I only have the options "Safe HTML" and "Plain text" (Jenkins with German translation). Changing to "Plain text" doesn't help, the result is still HTML code.

Any other idea where this might come from?

radek.antoniuk@quiddia.com (JIRA)

unread,
Oct 1, 2015, 5:41:01 AM10/1/15
to jenkinsc...@googlegroups.com

I have now tested with JIRA 6.3.0, jira-plugin 1.41, git-plugin 2.3.5 and 2.4.0, tried switching Raw/Escaped HTML and always worked fine for me. I made a screenshot with what I can see, it looks a bit different but that might be the new UI. Not sure why you still see "Safe HTML" and "Plain text"..

radek.antoniuk@quiddia.com (JIRA)

unread,
Oct 1, 2015, 5:42:02 AM10/1/15
to jenkinsc...@googlegroups.com
Radek Antoniuk updated an issue
 

My testing.
Change By: Radek Antoniuk
Attachment: j.png

carsten.pfeiffer@gebit.de (JIRA)

unread,
Oct 1, 2015, 8:23:01 AM10/1/15
to jenkinsc...@googlegroups.com

radek.antoniuk@quiddia.com (JIRA)

unread,
Oct 1, 2015, 8:42:01 AM10/1/15
to jenkinsc...@googlegroups.com

Can you try disabling some of them to see if it fixes it?

carsten.pfeiffer@gebit.de (JIRA)

unread,
Oct 1, 2015, 8:53:03 AM10/1/15
to jenkinsc...@googlegroups.com

Yes, will do, but cannot do it today anymore.

carsten.pfeiffer@gebit.de (JIRA)

unread,
Oct 2, 2015, 9:00:09 AM10/2/15
to jenkinsc...@googlegroups.com

FWIW, in a first test, I couldn't reproduce the problem on a new test machine. I'll dig some more to find out the cause.

radek.antoniuk@quiddia.com (JIRA)

unread,
Oct 26, 2015, 11:18:01 AM10/26/15
to jenkinsc...@googlegroups.com
Radek Antoniuk resolved as Incomplete
 

I'm closing it for now, feel free to reopen if you find anything interesting.
Change By: Radek Antoniuk
Status: Open Resolved
Resolution: Incomplete

ferruccio.bongianni@gmail.com (JIRA)

unread,
Jun 27, 2016, 5:14:02 AM6/27/16
to jenkinsc...@googlegroups.com
ferruccio bongianni commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

Hello,
I've got the same problem; has it been tackled / resolved?
Thanks
Ferruccio
This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c)
Atlassian logo

medianick@gmail.com (JIRA)

unread,
Jun 28, 2016, 11:09:01 AM6/28/16
to jenkinsc...@googlegroups.com

Same issue here. Jenkins 1.651.3 LTS, Git Client plugin 1.19.6, Git plugin 2.5.0, JIRA plugin 2.2.1, JIRA Plugin for Jenkins (from Marvelution) 1.5.5, Subversion plugin 2.6.

The Recent Changes link for the job (listing recent builds and their changes, at /job/

{job name}/changes) shows the JIRA links properly (unescaped), but the changes shown on the main page for each build (at /job/{job name}

/

{build number}

) shows the escaped URLs.

medianick@gmail.com (JIRA)

unread,
Jun 28, 2016, 11:10:03 AM6/28/16
to jenkinsc...@googlegroups.com
Nick Jones reopened an issue
 
Change By: Nick Jones
Resolution: Incomplete
Status: Resolved Reopened

medianick@gmail.com (JIRA)

unread,
Jun 28, 2016, 11:11:02 AM6/28/16
to jenkinsc...@googlegroups.com
Nick Jones edited a comment on Bug JENKINS-29075
Same issue here. Jenkins 1.651.3 LTS, Git Client plugin 1.19.6, Git plugin 2.5.0, JIRA plugin 2.2.1, JIRA Plugin for Jenkins (from Marvelution) 1.5.5, Subversion plugin 2.6.

The Recent Changes link for the job (listing recent builds and their changes, at /job/ {job name} _name_ /changes) shows the JIRA links properly (unescaped), but the changes shown on the main page for each build (at /job/ {job name} _name_ / {build number} _id_ ) shows the escaped URLs.

jbb.ve@free.fr (JIRA)

unread,
Aug 18, 2016, 3:45:01 AM8/18/16
to jenkinsc...@googlegroups.com
Sébastien Sébastien updated an issue
 
Change By: Sébastien Sébastien
Attachment: ok.png

jbb.ve@free.fr (JIRA)

unread,
Aug 18, 2016, 3:46:01 AM8/18/16
to jenkinsc...@googlegroups.com
Sébastien Sébastien commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

I got the same problem with
Jenkins ver. 2.7.2
JIRA plugin 2.2.1

Unable to render embedded object: File (nok.png) not found.

jbb.ve@free.fr (JIRA)

unread,
Aug 18, 2016, 3:47:01 AM8/18/16
to jenkinsc...@googlegroups.com
Sébastien Sébastien updated an issue
Change By: Sébastien Sébastien
Attachment: nok.png

jbb.ve@free.fr (JIRA)

unread,
Aug 18, 2016, 3:48:01 AM8/18/16
to jenkinsc...@googlegroups.com
I got the same problem with
* Jenkins ver. 2.7.2
 * JIRA plugin 2.2.1
!ok.png|thumbnail!
!nok.png|thumbnail!

andrei@k-tz.com (JIRA)

unread,
Sep 26, 2016, 3:40:01 PM9/26/16
to jenkinsc...@googlegroups.com
Andrei Barychev updated an issue
 
Change By: Andrei Barychev
Attachment: JIRA-5.4-vs-JIRA-6.2.png

andrei@k-tz.com (JIRA)

unread,
Sep 26, 2016, 3:41:01 PM9/26/16
to jenkinsc...@googlegroups.com
Andrei Barychev commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

I'm having this problem for a couple of months. My case may be helpful for the plugin developers though.

I have two JIRA servers. The first is running JIRA 5.4, with both SOAP and REST APIs enabled. The other is running JIRA 6.2, with REST API only.

I never had a problem with Jenkins displaying issues' details for projects hosted in JIRA 5.4 projects. However, Jenkins displays the escaped HTML for the issues in projects hosted by JIRA 6.2.

Please note, that the escaped HTML is displayed only on Build Status and Build Changes pages. The same issues are displayed correctly on the Project Changes page.

andrei@k-tz.com (JIRA)

unread,
Sep 26, 2016, 3:42:02 PM9/26/16
to jenkinsc...@googlegroups.com
Andrei Barychev edited a comment on Bug JENKINS-29075
I'm having this problem for a couple of months. My case may be helpful for the plugin developers though.

I have *two* JIRA servers. The first is running JIRA 5.4, with both SOAP and REST APIs enabled. The other is running JIRA 6.2, with REST API only.

I never had a problem with Jenkins displaying issues' details for projects hosted in by JIRA 5.4 projects . However, Jenkins displays the escaped HTML for the issues in projects hosted by JIRA 6.2.

Please note, that the {color:red}escaped HTML is displayed{color} only on *Build Status* and *Build Changes* pages. The {color:#14892c}same issues are displayed correctly{color} on the *Project Changes* page.

!JIRA-5.4-vs-JIRA-6.2.png|thumbnail!

andrei@k-tz.com (JIRA)

unread,
Sep 26, 2016, 3:58:02 PM9/26/16
to jenkinsc...@googlegroups.com
Andrei Barychev edited a comment on Bug JENKINS-29075
{color:#d04437}*Please disregard the below comment. I was totally wrong. After switching the Jenkins projects to the other JIRA, the 5.4 issues also appear in escaped HTML. My bad.*{color}

I 'm having this problem for a couple of months. My case may be helpful for the plugin developers though.


I have *two* JIRA servers. The first is running JIRA 5.4, with both SOAP and REST APIs enabled. The other is running JIRA 6.2, with REST API only.

I never had a problem with Jenkins displaying issues' details for projects hosted by JIRA 5.4. However, Jenkins displays the escaped HTML for the issues in projects hosted by JIRA 6.2.


Please note, that the {color:red}escaped HTML is displayed{color} only on *Build Status* and *Build Changes* pages. The {color:#14892c}same issues are displayed correctly{color} on the *Project Changes* page.

!JIRA-5.4-vs-JIRA-6.2.png|thumbnail!

carsten.pfeiffer@gebit.de (JIRA)

unread,
Sep 27, 2016, 3:48:03 AM9/27/16
to jenkinsc...@googlegroups.com

I just checked again and in our setup, this bug is gone:
jenkins 2.8
git-plugin 2.4.4

jdavis@ipswitch.com (JIRA)

unread,
Oct 15, 2016, 4:04:04 PM10/15/16
to jenkinsc...@googlegroups.com
Jason Davis updated an issue
 
Change By: Jason Davis
Attachment: p4-changes.png

jdavis@ipswitch.com (JIRA)

unread,
Oct 15, 2016, 4:06:01 PM10/15/16
to jenkinsc...@googlegroups.com
Jason Davis commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

I've noticed this issue with the P4 plugin. The overall project changes list is OK, but the change report for a single build is still showing the html for the link instead of actually showing the link.

jdavis@ipswitch.com (JIRA)

unread,
Oct 15, 2016, 4:07:03 PM10/15/16
to jenkinsc...@googlegroups.com
Jason Davis edited a comment on Bug JENKINS-29075
I've noticed this issue with the P4 plugin.  The overall project changes list is OK, but the change report for a single build is still showing the html for the link instead of actually showing the link.  

!p4-changes.png|thumbnail!

jenkins 2.25, JIRA plugin 2.2.1, p4 plugin 1.4.8

radek.antoniuk@quiddia.com (JIRA)

unread,
Oct 16, 2016, 5:54:02 PM10/16/16
to jenkinsc...@googlegroups.com
Radek Antoniuk resolved as Cannot Reproduce
 

Jason, do you mind opening a new issue for P4 as this issue was concerning git integration and it seems is currently resolved. Thanks!
Change By: Radek Antoniuk
Status: Reopened Resolved
Resolution: Cannot Reproduce

ljaderdev@gmail.com (JIRA)

unread,
Nov 5, 2016, 6:13:02 PM11/5/16
to jenkinsc...@googlegroups.com
Łukasz Jąder commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

This issue should be fixed in git-plugin since 2.3.4 - by commit:
https://github.com/jenkinsci/git-plugin/commit/930ac05035e5292dbdeea4f2135881a0d3f03060

Sébastien DK your job uses SVN, and subversion-plugin still needs the fix to be applied:
https://github.com/jenkinsci/subversion-plugin/pull/174

Probably other SCM like Perforce, or "SCM combining" plugins should be analyzed, if they are also affected.

Hope that helps.

ben.herfurth@develop-group.de (JIRA)

unread,
Jan 17, 2017, 3:43:02 AM1/17/17
to jenkinsc...@googlegroups.com

When will the fix for svn be released?

ben.herfurth@develop-group.de (JIRA)

unread,
Jan 17, 2017, 3:43:04 AM1/17/17
to jenkinsc...@googlegroups.com
Ben Herfurth edited a comment on Bug JENKINS-29075
When will the fix for the svn plugin be released?

mark.earl.waite@gmail.com (JIRA)

unread,
Jan 17, 2017, 6:16:02 AM1/17/17
to jenkinsc...@googlegroups.com

Conversations on subversion plugin PR174 with Daniel Beck and Oleg Nenashev indicate that the change has been approved but not yet merged.

mark.earl.waite@gmail.com (JIRA)

unread,
Jan 17, 2017, 6:16:05 AM1/17/17
to jenkinsc...@googlegroups.com
Mark Waite updated an issue
 
Change By: Mark Waite
Component/s: subversion-plugin

ben.herfurth@develop-group.de (JIRA)

unread,
Jan 17, 2017, 6:25:01 AM1/17/17
to jenkinsc...@googlegroups.com
Ben Herfurth commented on Bug JENKINS-29075
 
Re: List of changes escapes HTML output of jira-plugin

ok. thank you for the information!

Did not find them by myself :<

mark.earl.waite@gmail.com (JIRA)

unread,
Oct 22, 2019, 9:32:42 PM10/22/19
to jenkinsc...@googlegroups.com
Mark Waite closed an issue as Cannot Reproduce
 
Change By: Mark Waite
Status: Resolved Closed
This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)
Atlassian logo
Reply all
Reply to author
Forward
0 new messages