[JENKINS-73243] quote replacement string in symbol tooltips (#9347)

jenkinsci · Jun 6, 2024 · 5978ebe · 5978ebe
1 parent 8088382
commit 5978ebe
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 3 deletions.
diff --git a/core/src/main/java/org/jenkins/ui/symbol/Symbol.java b/core/src/main/java/org/jenkins/ui/symbol/Symbol.java
@@ -14,6 +14,7 @@
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import java.util.regex.Matcher;
 import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
@@ -72,13 +73,13 @@ public static String get(@NonNull SymbolRequest request) {
                 .computeIfAbsent(identifier, key -> new ConcurrentHashMap<>())
                 .computeIfAbsent(name, key -> loadSymbol(identifier, key));
         if ((tooltip != null && !tooltip.isBlank()) && (htmlTooltip == null || htmlTooltip.isBlank())) {
-            symbol = symbol.replaceAll("<svg", "<svg tooltip=\"" + Functions.htmlAttributeEscape(tooltip) + "\"");
+            symbol = symbol.replaceAll("<svg", Matcher.quoteReplacement("<svg tooltip=\"" + Functions.htmlAttributeEscape(tooltip) + "\""));
         }
         if (htmlTooltip != null && !htmlTooltip.isBlank()) {
-            symbol = symbol.replaceAll("<svg", "<svg data-html-tooltip=\"" + Functions.htmlAttributeEscape(htmlTooltip) + "\"");
+            symbol = symbol.replaceAll("<svg", Matcher.quoteReplacement("<svg data-html-tooltip=\"" + Functions.htmlAttributeEscape(htmlTooltip) + "\""));
         }
         if (id != null && !id.isBlank()) {
-            symbol = symbol.replaceAll("<svg", "<svg id=\"" + Functions.htmlAttributeEscape(id) + "\"");
+            symbol = symbol.replaceAll("<svg", Matcher.quoteReplacement("<svg id=\"" + Functions.htmlAttributeEscape(id) + "\""));
         }
         if (classes != null && !classes.isBlank()) {
             symbol = symbol.replaceAll("<svg", "<svg class=\"" + Functions.htmlAttributeEscape(classes) + "\"");

diff --git a/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java b/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java
@@ -7,6 +7,7 @@
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.jupiter.api.DisplayName;
+import org.jvnet.hudson.test.Issue;
 import org.jvnet.hudson.test.JenkinsRule;
 import org.jvnet.hudson.test.RealJenkinsRule;
 
@@ -15,6 +16,22 @@ public class SymbolJenkinsTest {
     public RealJenkinsRule rjr = new RealJenkinsRule()
             .addPlugins("plugins/design-library.jpi", "plugins/prism-api.jpi", "plugins/bootstrap5-api.jpi");
 
+    @Test
+    @Issue("JENKINS-73243")
+    @DisplayName("When resolving a symbol where the tooltip contains '$' no error is thrown")
+    public void dollarInToolTipSucceeds() throws Throwable {
+        rjr.then(SymbolJenkinsTest::_dollarInTooltipSucceeds);
+    }
+
+    private static void _dollarInTooltipSucceeds(JenkinsRule j) {
+        String symbol = Symbol.get(new SymbolRequest.Builder()
+                .withName("add")
+                .withTooltip("$test")
+                .build()
+        );
+        assertThat(symbol, containsString("tooltip=\"$test\""));
+    }
+
     @Test
     @DisplayName("When resolving a symbol from a missing plugin, the placeholder is generated instead")
     public void missingSymbolFromPluginDefaultsToPlaceholder() throws Throwable {