[JENKINS-73907] Fix double-escaped tooltips in "Help for feature" (je…

…nkinsci#10000) Co-authored-by: Daniel Beck <[email protected]>
krisstern · Nov 28, 2024 · f91ebb4 · f91ebb4
1 parent 5a574c9
commit f91ebb4
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/core/src/main/resources/lib/form/helpLink.jelly b/core/src/main/resources/lib/form/helpLink.jelly
@@ -55,7 +55,7 @@ THE SOFTWARE.
   </st:documentation>
   <j:choose>
     <j:when test="${attrs.url!=null}">
-      <j:set var="altText" value="${attrs.featureName != null ? '%Help for feature:' + ' ' + h.escape(attrs.featureName) : '%Help'}" />
+      <j:set var="altText" value="${attrs.featureName != null ? '%Help for feature:' + ' ' + attrs.featureName : '%Help'}" />
       <a href="#" class="jenkins-help-button" tooltip="${altText}" helpURL="${rootURL}${attrs.url}">
         <!-- .jenkins-help-button span element is required as it's restyled in CSS -->
         <span>?</span>

diff --git a/test/src/test/java/jenkins/security/Security2779Test.java b/test/src/test/java/jenkins/security/Security2779Test.java
@@ -49,7 +49,7 @@ private void noCrossSiteScriptingInHelp(String selector) throws Exception {
 
         // assert leading space to identify unintentional double-escaping (&amp;lt;) as test failure
         assertThat("tooltip does not contain dangerous HTML", jsResultString, not(containsString(" <img src=x")));
-        assertThat("tooltip contains safe text", jsResultString, containsString("lt;img src=x"));
+        assertThat("tooltip contains safe text", jsResultString, containsString(" &lt;img src=x"));
     }
 
     @TestExtension