From ec3381597daf1fc5eb7259b033d13693d6485918 Mon Sep 17 00:00:00 2001
From: Markus Winter <m.winter@sap.com>
Date: Mon, 3 Jun 2024 23:00:45 +0200
Subject: [PATCH 1/3] [JENKINS-73243] quote replacement string in symbol
 tooltips

when the tooltip or html tooltip for a symbol contained the $ sign,
then adding the tooltip failed with `Illegal group reference`.

e.g.

```
<l:icon src="symbol-add" tooltip="$test"/>
```

Added unit test that ensures tooltips are properly quoted
---
 .../main/java/org/jenkins/ui/symbol/Symbol.java   |  5 +++--
 .../org/jenkins/ui/symbol/SymbolJenkinsTest.java  | 15 +++++++++++++++
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/core/src/main/java/org/jenkins/ui/symbol/Symbol.java b/core/src/main/java/org/jenkins/ui/symbol/Symbol.java
index 9a07556d7c71..6302bcf747c0 100644
--- a/core/src/main/java/org/jenkins/ui/symbol/Symbol.java
+++ b/core/src/main/java/org/jenkins/ui/symbol/Symbol.java
@@ -14,6 +14,7 @@
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import java.util.regex.Matcher;
 import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
@@ -72,10 +73,10 @@ public static String get(@NonNull SymbolRequest request) {
                 .computeIfAbsent(identifier, key -> new ConcurrentHashMap<>())
                 .computeIfAbsent(name, key -> loadSymbol(identifier, key));
         if ((tooltip != null && !tooltip.isBlank()) && (htmlTooltip == null || htmlTooltip.isBlank())) {
-            symbol = symbol.replaceAll("<svg", "<svg tooltip=\"" + Functions.htmlAttributeEscape(tooltip) + "\"");
+            symbol = symbol.replaceAll("<svg", Matcher.quoteReplacement("<svg tooltip=\"" + Functions.htmlAttributeEscape(tooltip) + "\""));
         }
         if (htmlTooltip != null && !htmlTooltip.isBlank()) {
-            symbol = symbol.replaceAll("<svg", "<svg data-html-tooltip=\"" + Functions.htmlAttributeEscape(htmlTooltip) + "\"");
+            symbol = symbol.replaceAll("<svg", Matcher.quoteReplacement("<svg data-html-tooltip=\"" + Functions.htmlAttributeEscape(htmlTooltip) + "\""));
         }
         if (id != null && !id.isBlank()) {
             symbol = symbol.replaceAll("<svg", "<svg id=\"" + Functions.htmlAttributeEscape(id) + "\"");
diff --git a/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java b/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java
index 1609e5ff0e3c..a789634b53c1 100644
--- a/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java
+++ b/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java
@@ -15,6 +15,21 @@ public class SymbolJenkinsTest {
     public RealJenkinsRule rjr = new RealJenkinsRule()
             .addPlugins("plugins/design-library.jpi", "plugins/prism-api.jpi", "plugins/bootstrap5-api.jpi");
 
+    @Test
+    @DisplayName("When resolving a symbol where the tooltip contains '$' no error is thrown")
+    public void dollarInToolTipSucceeds() throws Throwable {
+        rjr.then(SymbolJenkinsTest::_dollarInTooltipSucceeds);
+    }
+
+    private static void _dollarInTooltipSucceeds(JenkinsRule j) {
+        String symbol = Symbol.get(new SymbolRequest.Builder()
+                .withName("add")
+                .withTooltip("$test")
+                .build()
+        );
+        assertThat(symbol, containsString("tooltip=\"$test\""));
+    }
+
     @Test
     @DisplayName("When resolving a symbol from a missing plugin, the placeholder is generated instead")
     public void missingSymbolFromPluginDefaultsToPlaceholder() throws Throwable {

From 8c5426a121bfecfdcd7bbee05ee1c2d656e8e186 Mon Sep 17 00:00:00 2001
From: Markus Winter <m.winter@sap.com>
Date: Mon, 3 Jun 2024 23:37:27 +0200
Subject: [PATCH 2/3] also quote id element

---
 core/src/main/java/org/jenkins/ui/symbol/Symbol.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/src/main/java/org/jenkins/ui/symbol/Symbol.java b/core/src/main/java/org/jenkins/ui/symbol/Symbol.java
index 6302bcf747c0..52c7faee0249 100644
--- a/core/src/main/java/org/jenkins/ui/symbol/Symbol.java
+++ b/core/src/main/java/org/jenkins/ui/symbol/Symbol.java
@@ -79,7 +79,7 @@ public static String get(@NonNull SymbolRequest request) {
             symbol = symbol.replaceAll("<svg", Matcher.quoteReplacement("<svg data-html-tooltip=\"" + Functions.htmlAttributeEscape(htmlTooltip) + "\""));
         }
         if (id != null && !id.isBlank()) {
-            symbol = symbol.replaceAll("<svg", "<svg id=\"" + Functions.htmlAttributeEscape(id) + "\"");
+            symbol = symbol.replaceAll("<svg", Matcher.quoteReplacement("<svg id=\"" + Functions.htmlAttributeEscape(id) + "\""));
         }
         if (classes != null && !classes.isBlank()) {
             symbol = symbol.replaceAll("<svg", "<svg class=\"" + Functions.htmlAttributeEscape(classes) + "\"");

From 22e8032a81c5f020954e55d671a71d613e63cb26 Mon Sep 17 00:00:00 2001
From: Markus Winter <m.winter@sap.com>
Date: Tue, 4 Jun 2024 10:38:08 +0200
Subject: [PATCH 3/3] add Issue

---
 test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java b/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java
index a789634b53c1..49aaa9cd4f52 100644
--- a/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java
+++ b/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java
@@ -7,6 +7,7 @@
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.jupiter.api.DisplayName;
+import org.jvnet.hudson.test.Issue;
 import org.jvnet.hudson.test.JenkinsRule;
 import org.jvnet.hudson.test.RealJenkinsRule;
 
@@ -16,6 +17,7 @@ public class SymbolJenkinsTest {
             .addPlugins("plugins/design-library.jpi", "plugins/prism-api.jpi", "plugins/bootstrap5-api.jpi");
 
     @Test
+    @Issue("JENKINS-73243")
     @DisplayName("When resolving a symbol where the tooltip contains '$' no error is thrown")
     public void dollarInToolTipSucceeds() throws Throwable {
         rjr.then(SymbolJenkinsTest::_dollarInTooltipSucceeds);