manually updated them with some tool assistance

core/src/main/resources/hudson/PluginManager/advanced.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   List of available new plugins
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="${%Update Center}" permission="${app.ADMINISTER}" norefresh="true">
   <st:include page="sidepanel.jelly"/>

core/src/main/resources/hudson/PluginManager/checkUpdates.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Forcibly check updates
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="${%Update Center}" permission="${app.ADMINISTER}" forcedUpdateCheck="true" norefresh="true">
   <st:include page="sidepanel.jelly"/>

core/src/main/resources/hudson/PluginManager/index.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Update Center main page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <local:table page="updates" list="${app.updateCenter.updates}" xmlns:local="/hudson/PluginManager">
     <div style="margin-top:1em">

core/src/main/resources/hudson/PluginManager/installed.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Config page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <l:layout title="${%Update Center}" permission="${app.ADMINISTER}" norefresh="true">
     <st:include page="sidepanel.jelly"/>

core/src/main/resources/hudson/PluginManager/sites.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Add/remove update center sites
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="${%Update Center}" permission="${app.ADMINISTER}" norefresh="true">
   <st:include page="sidepanel.jelly"/>

core/src/main/resources/hudson/PluginManager/table.jelly

@@ -29,6 +29,7 @@ THE SOFTWARE.
      list: variable to contain List<Plugin>
      page: page name to be passed to local:tabBar
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout title="${%Update Center}" permission="${app.ADMINISTER}" norefresh="true">
     <st:include page="sidepanel.jelly"/>

core/src/main/resources/hudson/atom.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson"><!-- No whitespace before xml header: -->&lt;?xml version="1.0" encoding="UTF-8"?&gt;
   <st:contentType value="application/atom+xml;charset=UTF-8" />
   <j:new var="h" className="hudson.Functions" /><!-- instead of JSP functions -->
@@ -46,14 +47,14 @@ THE SOFTWARE.
 
     <j:forEach var="e" items="${entries}" >
       <entry>
-        <title>${h.xmlEscape(adapter.getEntryTitle(e))}</title>
+        <title>${adapter.getEntryTitle(e)}</title>
         <link rel="alternate" type="text/html" href="${rootURL}${h.encode(adapter.getEntryUrl(e))}"/>
         <id>${adapter.getEntryID(e)}</id>
         <published>${h.xsDate(adapter.getEntryTimestamp(e))}</published>
         <updated>${h.xsDate(adapter.getEntryTimestamp(e))}</updated>
         <j:set var="desc" value="${adapter.getEntryDescription(e)}"/>
         <j:if test="${desc!=null}">
-          <content>${h.xmlEscape(desc)}</content>
+          <content>${desc}</content>
         </j:if>
       </entry>
     </j:forEach>

core/src/main/resources/hudson/diagnosis/HudsonHomeDiskUsageMonitor/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
 	<l:layout title="${%JENKINS_HOME is almost full}">
 		<l:main-panel>

core/src/main/resources/hudson/diagnosis/HudsonHomeDiskUsageMonitor/message.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <div class="warning">
     <form method="post" action="${rootURL}/${it.url}/act" name="${it.id}">

core/src/main/resources/hudson/diagnosis/NullIdDescriptorMonitor/message.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <div class="error">
     ${%blurb}

core/src/main/resources/hudson/diagnosis/OldDataMonitor/manage.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="${%Manage Old Data}" permission="${app.ADMINISTER}">
   <st:include page="sidepanel.jelly" it="${app}"/>

core/src/main/resources/hudson/diagnosis/ReverseProxySetupMonitor/message.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <script>
     var checkAjax=new Ajax.Request('${rootURL}/${it.url}/test', {

core/src/main/resources/hudson/lifecycle/WindowsInstallerLink/_restart.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <st:statusCode value="503" /><!-- SERVICE NOT AVAILABLE -->
   <l:layout permission="${app.ADMINISTER}">

core/src/main/resources/hudson/logging/LogRecorder/configure.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Config page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout norefresh="true">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorder/index.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Log view
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="Log" permission="${app.ADMINISTER}">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorderManager/all.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Show all hudson.* logs
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="Log">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorderManager/index.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Log view
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="${%Log}">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorderManager/levels.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Show form to adjust log levels
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="Log Levels">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractBuild/index.jelly

@@ -23,6 +23,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.fullDisplayName}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractItem/configure-common.jelly

@@ -26,6 +26,7 @@ THE SOFTWARE.
 <!--
   Parts of the configuration that applies to Project and MavenModuleSet.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:p="/lib/hudson/project" xmlns:this="this">
   <p:config-disableBuild/>
   <j:if test="${app.CONCURRENT_BUILD}">

core/src/main/resources/hudson/model/AbstractItem/delete.jelly

@@ -28,6 +28,7 @@ THE SOFTWARE.
   Some jobs cannot be deleted by the user, so this view is not necessarily
   applicable to all jobs.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
 		<st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractItem/noWorkspace.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- tell user that there's no workspace yet -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractModelObject/error.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <st:statusCode value="400" /><!-- clearly indicate that this page is an error page --> 
   <l:layout title="Jenkins">

core/src/main/resources/hudson/model/AbstractProject/changes.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Displays the console output
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${%changes.title(it.name)}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractProject/main.jelly

@@ -23,6 +23,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">
   <p:projectActionFloatingBox />
 

core/src/main/resources/hudson/model/AbstractProject/svn-password.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- show the icon legend -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AllView/noJob.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <div>
   <!--
     This is a good place to add "welcome" materials, like pointers to the website and etc

core/src/main/resources/hudson/model/Api/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
 	<l:layout title="Remote API">
 		<l:main-panel>

core/src/main/resources/hudson/model/BuildAuthorizationToken/config.jelly

@@ -27,6 +27,7 @@ THE SOFTWARE.
   Pseudo trigger configuration.
   Note that it is the object that owns BuildAuthorizationToken
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <j:if test="${app.useSecurity}">
     <f:optionalBlock name="pseudoRemoteTrigger"

core/src/main/resources/hudson/model/BuildTimelineWidget/control.jelly

@@ -21,6 +21,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <st:documentation>
     Show timeline trend image. It takes two builds

core/src/main/resources/hudson/model/Cause/UpstreamCause/description.jelly

@@ -21,6 +21,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
     <!-- upstreamUrl added in 1.284, so handle missing value -->
     <span>${it.upstreamUrl!=null ? "%started_by_project(it.upstreamProject,it.upstreamBuild.toString(),it.upstreamUrl,rootURL)" : it.shortDescription}</span>

core/src/main/resources/hudson/model/Cause/UserCause/description.jelly

@@ -21,6 +21,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
     <span>${%started_by_user(it.userName,rootURL)}</span>
 </j:jelly>

core/src/main/resources/hudson/model/Cause/description.jelly

@@ -21,6 +21,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
     <span>${it.shortDescription}</span>
 </j:jelly>

core/src/main/resources/hudson/model/CauseAction/summary.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <t:summary icon="orange-square.gif">
     <j:forEach var="entry" items="${it.causeCounts.entrySet()}">

core/src/main/resources/hudson/model/ChoiceParameterDefinition/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/Computer/_scriptText.jelly

@@ -25,5 +25,6 @@ THE SOFTWARE.
 <!--
   Called from doScriptText() to display the execution result.
 -->
+<?jelly escape-by-default='false'?>
 <st:compress xmlns:j="jelly:core" xmlns:st="jelly:stapler">
 <st:contentType value="text/plain;charset=UTF-8" />${output}</st:compress>
\ No newline at end of file

core/src/main/resources/hudson/model/Computer/builds.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.displayName}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Computer/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.displayName}">
     <st:include page="sidepanel.jelly" />
@@ -48,7 +49,7 @@ THE SOFTWARE.
         <img src="${imagesURL}/48x48/${it.icon}" width="48" height="48" alt=""/>
         ${it.caption}
         <j:if test="${!empty(it.node.nodeDescription)}">
-          <span style="font-size:smaller">(${it.node.nodeDescription})</span>
+          <span style="font-size:smaller">(<j:out value="${it.node.nodeDescription}"/>)</span>
         </j:if>
       </h1>
 

core/src/main/resources/hudson/model/Computer/markOffline.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${%title(it.displayName)}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/ComputerSet/index.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Entrance to the configuration page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
 <l:layout title="${%Nodes}">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/DirectoryBrowserSupport/dir.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- Show files in the workspace -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.title} : ${path}">
     <st:include page="sidepanel.jelly" it="${it.owner}"/>
@@ -33,7 +34,7 @@ THE SOFTWARE.
           <form action="${backPath}" method="get">
             <a href="${topPath}"><img src="${imagesURL}/48x48/${icon}" class="rootIcon" alt="" height="48" width="48"/></a>
             <j:forEach var="p" items="${parentPath}">
-              <a href="${p.href}">${h.xmlEscape(p.title)}</a>
+              <a href="${p.href}">${p.title}</a>
               /
             </j:forEach>
             <input type="text" name="pattern" value="${pattern}" />
@@ -58,10 +59,10 @@ THE SOFTWARE.
                     
                       <j:choose>
                         <j:when test="${x.readable}">
-                          <a href="${t.href}">${h.xmlEscape(t.title)}</a>
+                          <a href="${t.href}">${t.title}</a>
                         </j:when>
                         <j:otherwise>
-                          ${h.xmlEscape(t.title)}
+                          ${t.title}
                         </j:otherwise>
                       </j:choose>
                       

core/src/main/resources/hudson/model/DownloadService/footer.jelly

@@ -29,6 +29,7 @@ THE SOFTWARE.
 
   This file is pulled into the layout.jelly
 -->
+<?jelly escape-by-default='false'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   ${it.generateFragment()}
 </j:jelly>

core/src/main/resources/hudson/model/Executor/causeOfDeath.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.name}">
     <l:header />

core/src/main/resources/hudson/model/ExternalJob/newJobDetail.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <div>
   ${%body}
 </div>
\ No newline at end of file

core/src/main/resources/hudson/model/FileParameterValue/value.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/Fingerprint/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
     <l:header title="${it.fileName}">

core/src/main/resources/hudson/model/Hudson/_api.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <h2>Create Job</h2>
   <p>

core/src/main/resources/hudson/model/Hudson/_cli.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout norefresh="true">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Hudson/_scriptText.jelly

@@ -25,5 +25,6 @@ THE SOFTWARE.
 <!--
   Called from doScriptText() to display the execution result.
 -->
+<?jelly escape-by-default='false'?>
 <st:compress xmlns:j="jelly:core" xmlns:st="jelly:stapler">
 <st:contentType value="text/plain;charset=UTF-8" />${output}</st:compress>
\ No newline at end of file

core/src/main/resources/hudson/model/Hudson/fingerprintCheck.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   New View page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout norefresh="true" title="${%Check File Fingerprint}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Hudson/login.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout norefresh="true">
     <l:hasPermission permission="${app.READ}">

core/src/main/resources/hudson/model/Hudson/manage.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Entrance to the configuration page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="${%Manage Jenkins}" xmlns:local="local" permission="${app.ADMINISTER}">
   <d:taglib uri="local">
@@ -101,7 +102,7 @@ THE SOFTWARE.
       <j:forEach var="m" items="${it.managementLinks}">
         <j:if test="${m.iconFileName!=null}">
           <local:feature icon="${m.iconFileName}"      href="${m.urlName}"   title="${m.displayName}">
-            ${m.description}
+            <j:out value="${m.description}"/>
           </local:feature>
         </j:if>
       </j:forEach>

core/src/main/resources/hudson/model/Hudson/newView.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   New View page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout norefresh="true" permission="${app.primaryView.CREATE}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Hudson/noPrincipal.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- there seems to be no authentication -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout>
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Hudson/opensearch.xml.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   OpenSearch description for using search box from browsers
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 ><st:contentType value="application/xml;charset=UTF-8"
 /><OpenSearchDescription xmlns="http://a9.com/-/spec/opensearch/1.1/">

core/src/main/resources/hudson/model/Hudson/projectRelationship-help.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout>
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Hudson/threadDump.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Produces stack dump of all threads by using JMX.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout permission="${app.ADMINISTER}" title="${%Thread dump}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Hudson/whoAmI.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- show debug information about the current user -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <l:layout>
     <l:hasPermission permission="${app.READ}">

core/src/main/resources/hudson/model/Job/buildTimeTrend.jelly

@@ -24,6 +24,7 @@ THE SOFTWARE.
 -->
 
 <!-- Displays the chart that show how long builds are taking -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${%title(it.displayName)}">
 		<st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Job/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">
   <l:layout title="${it.displayName}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Job/rename.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- Rename project -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Label/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.displayName}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/LoadStatistics/main.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- renders an HTML fragment that shows trend graph -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <h1>
     <img src="${imagesURL}/48x48/monitor.gif" alt="" height="48" width="48"/>

core/src/main/resources/hudson/model/MyViewsProperty/newView.jelly

@@ -28,6 +28,7 @@ THE SOFTWARE.
   
   TODO remove duplication with Hudson/newView.jelly
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout norefresh="true" permission="${app.primaryView.CREATE}">
     <st:include page="sidepanel.jelly" it="${it.user}"/>

core/src/main/resources/hudson/model/NoFingerprintMatch/index.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- used when fingerprint had no match -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
     <l:header title="${%No matching record found}" />
@@ -38,7 +39,7 @@ THE SOFTWARE.
       </h1>
 
       <p>
-        ${%description(h.escape(it.displayName))}
+        ${%description(it.displayName)}
       </p>
       <ol>
         <li>

core/src/main/resources/hudson/model/ParametersDefinitionProperty/index.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   This view is rendered as /hudson/job/XYZ/build
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/PermalinkProjectAction/Permalink/link.jelly

@@ -27,6 +27,7 @@ THE SOFTWARE.
 
   'job' must be bound to the parent job scope.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:p="/lib/hudson/project">
   <j:set var="b" value="${it.resolve(job)}"/>
   <j:if test="${b!=null}">

core/src/main/resources/hudson/model/ProxyView/configure-entries.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
     <f:entry title="${%View name}"
     description="${%The name of a global view that will be shown.}">

core/src/main/resources/hudson/model/Run/artifacts-index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <j:if test="${!h.isArtifactsPermissionEnabled() or h.isArtifactsPermissionEnabled() and h.hasPermission(it.ARTIFACTS)}">
     <l:layout title="${it.fullDisplayName} Artifacts">
@@ -32,7 +33,7 @@ THE SOFTWARE.
         </t:buildCaption>
         <ul>
           <j:forEach var="f" items="${it.artifacts}">
-            <li><a href="artifact/${f.href}">${h.xmlEscape(f.displayPath)}</a></li>
+            <li><a href="artifact/${f.href}">${f.displayPath}</a></li>
           </j:forEach>
         </ul>
       </l:main-panel>

core/src/main/resources/hudson/model/Run/confirmDelete.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- Confirm deletion of the build/run -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.fullDisplayName}" norefresh="true">
 		<st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Run/console.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Displays the console output
 -->
+<?jelly escape-by-default='true'?>
 <st:compress xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.fullDisplayName} Console" norefresh="true">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/RunParameterDefinition/config.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/RunParameterDefinition/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/RunParameterValue/value.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/Slave/help-launcher.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:ajax>
     <div>

core/src/main/resources/hudson/model/TaskAction/log.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Include this in the main page to display the log
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <j:choose>
     <!-- Do progressive console output -->

core/src/main/resources/hudson/model/UpdateCenter/ConnectionCheckJob/row.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <tr id="row${it.id}">
     <td style="vertical-align: top; padding-right:1em">${%Preparation}</td>

core/src/main/resources/hudson/model/UpdateCenter/CoreUpdateMonitor/message.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <div class="warning">
     <j:set var="ucData" value="${it.data}" />

core/src/main/resources/hudson/model/UpdateCenter/DownloadJob/Failure/status.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <div>
     <img src="${imagesURL}/24x24/red.gif" alt="" height="24" width="24"/> ${%Failure}

core/src/main/resources/hudson/model/UpdateCenter/DownloadJob/row.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <tr id="row${it.id}">
     <td style="vertical-align: top; padding-right:1em">${it.name}</td>

core/src/main/resources/hudson/model/UpdateCenter/PageDecoratorImpl/footer.jelly

@@ -29,6 +29,7 @@ THE SOFTWARE.
 
   This file is pulled into the layout.jelly
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <j:forEach var="site" items="${app.updateCenter.sites}">
     <j:if test="${site.due or forcedUpdateCheck}">

core/src/main/resources/hudson/model/UsageStatistics/footer.jelly

@@ -29,6 +29,7 @@ THE SOFTWARE.
 
   This file is pulled into the layout.jelly
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <j:if test="${it.due}">
     <script>

core/src/main/resources/hudson/model/View/People/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${%People} - ${it.parent.viewName}">
     <st:include page="sidepanel.jelly" it="${it.parent}" />

core/src/main/resources/hudson/model/View/builds.jelly

@@ -23,6 +23,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.displayName}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/View/noJob.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core">
     <style type="text/css">
         #noJobDiv {

core/src/main/resources/hudson/model/queue/CauseOfBlockage/BecauseLabelIsBusy/summary.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <st:structuredMessageFormat key="description">
     <st:structuredMessageArgument>

core/src/main/resources/hudson/model/queue/CauseOfBlockage/BecauseLabelIsOffline/summary.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <st:structuredMessageFormat key="description">
     <st:structuredMessageArgument>

core/src/main/resources/hudson/model/queue/CauseOfBlockage/summary.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core">
   <!-- defaults to short description -->
   ${it.shortDescription}

core/src/main/resources/hudson/node_monitors/ArchitectureMonitor/column.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <td align="middle">${data}</td>
 </j:jelly>
\ No newline at end of file

core/src/main/resources/hudson/node_monitors/ClockMonitor/column.jelly

@@ -22,13 +22,14 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <j:choose>
     <j:when test="${data==null}">
       <td align="right" data="-1">N/A</td>
     </j:when>
     <j:otherwise>
-      <td align="right" data="${data.abs()}">${data.toHtml()}</td>
+      <td align="right" data="${data.abs()}"><j:out value="${data.toHtml()}"/></td>
     </j:otherwise>
   </j:choose>
 </j:jelly>
\ No newline at end of file

core/src/main/resources/hudson/node_monitors/DiskSpaceMonitor/column.jelly

@@ -22,13 +22,14 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <j:choose>
     <j:when test="${data==null}">
       <td align="right" data="-1">N/A</td>
     </j:when>
     <j:otherwise>
-      <td align="right" data="${data}">${data.toHtml()}</td>
+      <td align="right" data="${data}"><j:out value="${data.toHtml()}"/></td>
     </j:otherwise>
   </j:choose>
 </j:jelly>
\ No newline at end of file

core/src/main/resources/hudson/node_monitors/DiskSpaceMonitorDescriptor/DiskSpace/cause.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <p class="error">${%blurb(it.gbLeft)}</p>
 </j:jelly>

core/src/main/resources/hudson/node_monitors/MonitorMarkedNodeOffline/message.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <div class="warning">
     <form method="post" action="${rootURL}/${it.url}/disable">

core/src/main/resources/hudson/node_monitors/ResponseTimeMonitor/column.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <j:choose>
     <j:when test="${data==null}">

core/src/main/resources/hudson/node_monitors/SwapSpaceMonitor/column.jelly

@@ -22,13 +22,14 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <j:choose>
     <j:when test="${data==null}">
       <td align="right" data="-1">N/A</td>
     </j:when>
     <j:otherwise>
-      <td align="right" data="${from.toMB(data)}">${from.toHtml(data)}</td>
+      <td align="right" data="${from.toMB(data)}"><j:out value="${from.toHtml(data)}"/></td>
     </j:otherwise>
   </j:choose>
 </j:jelly>
\ No newline at end of file

core/src/main/resources/hudson/node_monitors/TemporarySpaceMonitor/column.jelly

@@ -22,13 +22,14 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <j:choose>
     <j:when test="${data==null}">
       <td align="right" data="-1">N/A</td>
     </j:when>
     <j:otherwise>
-      <td align="right" data="${data}">${data.toHtml()}</td>
+      <td align="right" data="${data}"><j:out value="${data.toHtml()}"/></td>
     </j:otherwise>
   </j:choose>
 </j:jelly>
\ No newline at end of file

core/src/main/resources/hudson/os/solaris/ZFSInstaller/confirm.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout title="${%ZFS file system creation}">
     <l:header />

core/src/main/resources/hudson/os/windows/ManagedWindowsServiceLauncher/help.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   ${%blurb}
 </j:jelly>
\ No newline at end of file

core/src/main/resources/hudson/rss20.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson"><!-- No whitespace before xml header: -->&lt;?xml version="1.0" encoding="UTF-8"?&gt;
   <st:contentType value="text/xml;charset=UTF-8" />
   <j:new var="h" className="hudson.Functions" /><!-- instead of JSP functions -->
@@ -35,14 +36,14 @@ THE SOFTWARE.
 
       <j:forEach var="e" items="${entries}" >
         <item>
-          <title>${h.xmlEscape(adapter.getEntryTitle(e))}</title>
+          <title>${adapter.getEntryTitle(e)}</title>
           <link>${rootURL}${h.encode(adapter.getEntryUrl(e))}</link>
           <guid isPermaLink="false">${adapter.getEntryID(e)}</guid>
           <pubDate>${h.rfc822Date(adapter.getEntryTimestamp(e))}</pubDate>
           <author><st:out value="${adapter.getEntryAuthor(e)}"/></author>
           <j:set var="desc" value="${adapter.getEntryDescription(e)}"/>
           <j:if test="${desc!=null}">
-            <description>${h.xmlEscape(desc)}</description>
+            <description>${desc}</description>
           </j:if>
         </item>
       </j:forEach>

core/src/main/resources/hudson/scm/AbstractScmTagAction/inProgress.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout norefresh="true">
     <st:include it="${it.build}" page="sidepanel.jelly" />