From 5978ebe594585ea6ebff22d0e34f3b2ada70f898 Mon Sep 17 00:00:00 2001
From: Markus Winter <m.winter@sap.com>
Date: Thu, 6 Jun 2024 14:20:38 +0200
Subject: [PATCH] [JENKINS-73243] quote replacement string in symbol tooltips
 (#9347)

---
 .../main/java/org/jenkins/ui/symbol/Symbol.java |  7 ++++---
 .../jenkins/ui/symbol/SymbolJenkinsTest.java    | 17 +++++++++++++++++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/core/src/main/java/org/jenkins/ui/symbol/Symbol.java b/core/src/main/java/org/jenkins/ui/symbol/Symbol.java
index 9a07556d7c71..52c7faee0249 100644
--- a/core/src/main/java/org/jenkins/ui/symbol/Symbol.java
+++ b/core/src/main/java/org/jenkins/ui/symbol/Symbol.java
@@ -14,6 +14,7 @@
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.logging.Level;
 import java.util.logging.Logger;
+import java.util.regex.Matcher;
 import javax.xml.XMLConstants;
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
@@ -72,13 +73,13 @@ public static String get(@NonNull SymbolRequest request) {
                 .computeIfAbsent(identifier, key -> new ConcurrentHashMap<>())
                 .computeIfAbsent(name, key -> loadSymbol(identifier, key));
         if ((tooltip != null && !tooltip.isBlank()) && (htmlTooltip == null || htmlTooltip.isBlank())) {
-            symbol = symbol.replaceAll("<svg", "<svg tooltip=\"" + Functions.htmlAttributeEscape(tooltip) + "\"");
+            symbol = symbol.replaceAll("<svg", Matcher.quoteReplacement("<svg tooltip=\"" + Functions.htmlAttributeEscape(tooltip) + "\""));
         }
         if (htmlTooltip != null && !htmlTooltip.isBlank()) {
-            symbol = symbol.replaceAll("<svg", "<svg data-html-tooltip=\"" + Functions.htmlAttributeEscape(htmlTooltip) + "\"");
+            symbol = symbol.replaceAll("<svg", Matcher.quoteReplacement("<svg data-html-tooltip=\"" + Functions.htmlAttributeEscape(htmlTooltip) + "\""));
         }
         if (id != null && !id.isBlank()) {
-            symbol = symbol.replaceAll("<svg", "<svg id=\"" + Functions.htmlAttributeEscape(id) + "\"");
+            symbol = symbol.replaceAll("<svg", Matcher.quoteReplacement("<svg id=\"" + Functions.htmlAttributeEscape(id) + "\""));
         }
         if (classes != null && !classes.isBlank()) {
             symbol = symbol.replaceAll("<svg", "<svg class=\"" + Functions.htmlAttributeEscape(classes) + "\"");
diff --git a/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java b/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java
index 1609e5ff0e3c..49aaa9cd4f52 100644
--- a/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java
+++ b/test/src/test/java/org/jenkins/ui/symbol/SymbolJenkinsTest.java
@@ -7,6 +7,7 @@
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.jupiter.api.DisplayName;
+import org.jvnet.hudson.test.Issue;
 import org.jvnet.hudson.test.JenkinsRule;
 import org.jvnet.hudson.test.RealJenkinsRule;
 
@@ -15,6 +16,22 @@ public class SymbolJenkinsTest {
     public RealJenkinsRule rjr = new RealJenkinsRule()
             .addPlugins("plugins/design-library.jpi", "plugins/prism-api.jpi", "plugins/bootstrap5-api.jpi");
 
+    @Test
+    @Issue("JENKINS-73243")
+    @DisplayName("When resolving a symbol where the tooltip contains '$' no error is thrown")
+    public void dollarInToolTipSucceeds() throws Throwable {
+        rjr.then(SymbolJenkinsTest::_dollarInTooltipSucceeds);
+    }
+
+    private static void _dollarInTooltipSucceeds(JenkinsRule j) {
+        String symbol = Symbol.get(new SymbolRequest.Builder()
+                .withName("add")
+                .withTooltip("$test")
+                .build()
+        );
+        assertThat(symbol, containsString("tooltip=\"$test\""));
+    }
+
     @Test
     @DisplayName("When resolving a symbol from a missing plugin, the placeholder is generated instead")
     public void missingSymbolFromPluginDefaultsToPlaceholder() throws Throwable {