From 8b1d59645725e6f01057c1cf87170e321f99f6be Mon Sep 17 00:00:00 2001
From: Kevin-CB <kguerroudj@cloudbees.com>
Date: Tue, 5 Apr 2022 14:10:26 +0200
Subject: [PATCH] SECURITY-2703

---
 .../parameters/Base64EncodedStringParameterValue/rebuild.jelly | 3 ++-
 .../parameters/Base64EncodedStringParameterValue/value.jelly   | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/src/main/resources/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/rebuild.jelly b/src/main/resources/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/rebuild.jelly
index 09d36aff0..f080fc007 100644
--- a/src/main/resources/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/rebuild.jelly
+++ b/src/main/resources/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/rebuild.jelly
@@ -26,7 +26,8 @@ THE SOFTWARE.
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
         xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
         xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">
-        <f:entry title="${it.name}" description="${it.description}">
+        <j:set var="escapeEntryTitleAndDescription" value="false"/>
+        <f:entry title="${h.escape(it.name)}" description="${it.formattedDescription}">
             <div name="parameter" description="${it.description}">
                 <input type="hidden" name="name" value="${it.name}" />
                 <f:textbox name="value" value="${it.value}" readonly="true" />
diff --git a/src/main/resources/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/value.jelly b/src/main/resources/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/value.jelly
index 17b7c4bcd..196cc848a 100644
--- a/src/main/resources/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/value.jelly
+++ b/src/main/resources/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/parameters/Base64EncodedStringParameterValue/value.jelly
@@ -26,7 +26,8 @@ THE SOFTWARE.
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
         xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
         xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">
-        <f:entry title="${it.name}" description="${it.description}">
+        <j:set var="escapeEntryTitleAndDescription" value="false"/>
+        <f:entry title="${h.escape(it.name)}" description="${it.formattedDescription}">
             <input type="hidden" name="name" value="${it.name}" />
             <f:textbox name="value" value="${it.value}" readonly="true" />
         </f:entry>