merged back the RC branch

Conflicts:
	core/src/main/resources/hudson/security/GlobalMatrixAuthorizationStrategy/config.jelly

changelog.html

@@ -87,8 +87,14 @@ Upcoming changes</a>
 
 <!-- these changes are controlled by the release process. DO NOT MODIFY -->
 <div id="rc" style="display:none;"><!--=BEGIN=-->
-<h3><a name=v1.407>What's new in 1.407</a> <!--=DATE=--></h3>
+<h3><a name=v1.408>What's new in 1.408</a> <!--=DATE=--></h3>
+<!--=RC-CHANGES=-->
+</div><!--=END=-->
+<h3><a name=v1.407>What's new in 1.407</a> (2011/04/15)</h3>
 <ul class=image>
+  <li class='major bug'>
+    Implemented comprehensive preventive measure against cross-site scripting. 
+    (SECURITY-14)
   <li class=bug>
     Javadoc links on maven job page with only one module
     (<a href="http://issues.jenkins-ci.org/browse/JENKINS-9202">issue 9202</a>)
@@ -107,8 +113,9 @@ Upcoming changes</a>
   <li class=bug>
     Fixed "AdjunctManager is not installed" error when Jenkins failed to startup.
     (<a href="http://issues.jenkins-ci.org/browse/JENKINS-9271">issue 9271</a>)
+  <li class=rfe>
+    Jenkins has a new logo, thanks to Charles Lowell at The Frontside
 </ul>
-</div><!--=END=-->
 <h3><a name=v1.406>What's new in 1.406</a> (2011/04/11)</h3>
 <ul class=image>
   <li class=bug>

core/pom.xml

@@ -389,7 +389,7 @@ THE SOFTWARE.
     <dependency>
       <groupId>org.kohsuke.stapler</groupId>
       <artifactId>stapler-jelly</artifactId>
-      <version>1.162</version>
+      <version>1.164</version>
       <exclusions>
         <exclusion>
           <groupId>commons-jelly</groupId>

core/src/main/java/hudson/Functions.java

@@ -84,6 +84,7 @@ import org.kohsuke.stapler.Ancestor;
 import org.kohsuke.stapler.Stapler;
 import org.kohsuke.stapler.StaplerRequest;
 import org.kohsuke.stapler.StaplerResponse;
+import org.kohsuke.stapler.jelly.InternationalizedStringExpression.RawHtmlArgument;
 
 import javax.servlet.ServletException;
 import javax.servlet.http.Cookie;
@@ -538,6 +539,10 @@ public class Functions {
         return Util.xmlEscape(s);
     }
 
+    public static String xmlUnescape(String s) {
+        return s.replace("&lt;","<").replace("&gt;",">").replace("&amp;","&");
+    }
+
     public static String htmlAttributeEscape(String text) {
         StringBuilder buf = new StringBuilder(text.length()+64);
         for( int i=0; i<text.length(); i++ ) {
@@ -1365,4 +1370,11 @@ public class Functions {
         }
         return r;
     }
+
+    /**
+     * Used for arguments to internationalized expressions to avoid escape
+     */
+    public static Object rawHtml(Object o) {
+        return o==null ? null : new RawHtmlArgument(o);
+    }
 }

core/src/main/java/hudson/init/Initializer.java

@@ -36,7 +36,7 @@ import static hudson.init.InitMilestone.STARTED;
 import static hudson.init.InitMilestone.COMPLETED;
 
 /**
- * Placed on static methods to indicate that this method is to be run during the Hudson start up to perform
+ * Placed on static methods to indicate that this method is to be run during the Jenkins start up to perform
  * some sort of initialization tasks.
  *
  * <h3>Example</h3>

core/src/main/resources/hudson/PluginManager/advanced.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   List of available new plugins
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="${%Update Center}" permission="${app.ADMINISTER}" norefresh="true">
   <st:include page="sidepanel.jelly"/>

core/src/main/resources/hudson/PluginManager/available.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   List of available new plugins    
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <local:table page="available" list="${app.updateCenter.categorizedAvailables}" xmlns:local="/hudson/PluginManager" />
 </j:jelly>

core/src/main/resources/hudson/PluginManager/checkUpdates.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Forcibly check updates
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="${%Update Center}" permission="${app.ADMINISTER}" forcedUpdateCheck="true" norefresh="true">
   <st:include page="sidepanel.jelly"/>

core/src/main/resources/hudson/PluginManager/index.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Update Center main page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <local:table page="updates" list="${app.updateCenter.updates}" xmlns:local="/hudson/PluginManager">
     <div style="margin-top:1em">

core/src/main/resources/hudson/PluginManager/installed.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Config page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <l:layout title="${%Update Center}" permission="${app.ADMINISTER}" norefresh="true">
     <st:include page="sidepanel.jelly"/>

core/src/main/resources/hudson/PluginManager/sidepanel.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Side panel
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <l:header />
   <l:side-panel>

core/src/main/resources/hudson/PluginManager/sites.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Add/remove update center sites
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="${%Update Center}" permission="${app.ADMINISTER}" norefresh="true">
   <st:include page="sidepanel.jelly"/>

core/src/main/resources/hudson/PluginManager/tabBar.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   List of available new plugins
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:tabBar>
     <l:tab name="${%Updates}" active="${page=='updates'}" href="." />

core/src/main/resources/hudson/PluginManager/table.jelly

@@ -29,6 +29,7 @@ THE SOFTWARE.
      list: variable to contain List<Plugin>
      page: page name to be passed to local:tabBar
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout title="${%Update Center}" permission="${app.ADMINISTER}" norefresh="true">
     <st:include page="sidepanel.jelly"/>

core/src/main/resources/hudson/TcpSlaveAgentListener/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <!--
     Publicize the TCP port number for JNLP slave agents so that they know where to conenct.

core/src/main/resources/hudson/atom.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson"><!-- No whitespace before xml header: -->&lt;?xml version="1.0" encoding="UTF-8"?&gt;
   <st:contentType value="application/atom+xml;charset=UTF-8" />
   <j:new var="h" className="hudson.Functions" /><!-- instead of JSP functions -->
@@ -46,14 +47,14 @@ THE SOFTWARE.
 
     <j:forEach var="e" items="${entries}" >
       <entry>
-        <title>${h.xmlEscape(adapter.getEntryTitle(e))}</title>
+        <title>${adapter.getEntryTitle(e)}</title>
         <link rel="alternate" type="text/html" href="${rootURL}${h.encode(adapter.getEntryUrl(e))}"/>
         <id>${adapter.getEntryID(e)}</id>
         <published>${h.xsDate(adapter.getEntryTimestamp(e))}</published>
         <updated>${h.xsDate(adapter.getEntryTimestamp(e))}</updated>
         <j:set var="desc" value="${adapter.getEntryDescription(e)}"/>
         <j:if test="${desc!=null}">
-          <content>${h.xmlEscape(desc)}</content>
+          <content>${desc}</content>
         </j:if>
       </entry>
     </j:forEach>

core/src/main/resources/hudson/diagnosis/HudsonHomeDiskUsageMonitor/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
 	<l:layout title="${%JENKINS_HOME is almost full}">
 		<l:main-panel>

core/src/main/resources/hudson/diagnosis/HudsonHomeDiskUsageMonitor/message.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <div class="warning">
     <form method="post" action="${rootURL}/${it.url}/act" name="${it.id}">

core/src/main/resources/hudson/diagnosis/MemoryUsageMonitor/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.displayName} Memory Usage">
     <!-- TODO: where in the tree structure should this really belong? -->

core/src/main/resources/hudson/diagnosis/NullIdDescriptorMonitor/message.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <div class="error">
     ${%blurb}

core/src/main/resources/hudson/diagnosis/OldDataMonitor/manage.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="${%Manage Old Data}" permission="${app.ADMINISTER}">
   <st:include page="sidepanel.jelly" it="${app}"/>

core/src/main/resources/hudson/diagnosis/OldDataMonitor/message.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <div class="warning">
     <form method="post" action="${rootURL}/${it.url}/act" name="${it.id}">

core/src/main/resources/hudson/diagnosis/ReverseProxySetupMonitor/message.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <script>
     var checkAjax=new Ajax.Request('${rootURL}/${it.url}/test', {

core/src/main/resources/hudson/diagnosis/TooManyJobsButNoView/message.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <div class="warning">
     <form method="post" action="${rootURL}/${it.url}/act" name="${it.id}">

core/src/main/resources/hudson/lifecycle/WindowsInstallerLink/_restart.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <st:statusCode value="503" /><!-- SERVICE NOT AVAILABLE -->
   <l:layout permission="${app.ADMINISTER}">

core/src/main/resources/hudson/lifecycle/WindowsInstallerLink/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout permission="${app.ADMINISTER}" title="${%Install as Windows Service}">
     <st:include it="${app}" page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorder/configure.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Config page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout norefresh="true">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorder/delete.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Displays the button to delete the build.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorder/index.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Log view
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="Log" permission="${app.ADMINISTER}">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorder/sidepanel.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Side panel for the log recorder
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:header />
   <l:side-panel>

core/src/main/resources/hudson/logging/LogRecorderManager/all.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Show all hudson.* logs
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="Log">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorderManager/feeds.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- list of feed links -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <div align="right" style="margin:1em">
     <img src="${imagesURL}/atom.gif" border="0" alt="Feed" height="16" width="16"/>

core/src/main/resources/hudson/logging/LogRecorderManager/index.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Log view
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="${%Log}">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorderManager/levels.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Show form to adjust log levels
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 <l:layout title="Log Levels">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorderManager/new.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Create a new LogRecorder
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout norefresh="true">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/logging/LogRecorderManager/sidepanel.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Side panel
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <l:header />
   <l:side-panel>

core/src/main/resources/hudson/markup/RawHtmlMarkupFormatter/config.jelly

 <!-- no config -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <f:description>
     ${%blurb}

core/src/main/resources/hudson/model/AbstractBuild/changes.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Displays the console output
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.fullDisplayName} ${%Changes}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractBuild/index.jelly

@@ -23,6 +23,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.fullDisplayName}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractBuild/sidepanel.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Side panel for the build view.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:header />
   <l:side-panel>

core/src/main/resources/hudson/model/AbstractBuild/tasks.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Side panel for the build view.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
       <l:task icon="images/24x24/up.gif" href="${it.upUrl}" title="${%Back to Project}" />
       <l:task icon="images/24x24/search.gif" href="${buildUrl.baseUrl}/" title="${%Status}" />

core/src/main/resources/hudson/model/AbstractItem/configure-common.jelly

@@ -26,6 +26,7 @@ THE SOFTWARE.
 <!--
   Parts of the configuration that applies to Project and MavenModuleSet.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:p="/lib/hudson/project" xmlns:this="this">
   <p:config-disableBuild/>
   <j:if test="${app.CONCURRENT_BUILD}">

core/src/main/resources/hudson/model/AbstractItem/delete.jelly

@@ -28,6 +28,7 @@ THE SOFTWARE.
   Some jobs cannot be deleted by the user, so this view is not necessarily
   applicable to all jobs.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
 		<st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractItem/noWorkspace.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- tell user that there's no workspace yet -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractModelObject/descriptionForm.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Used by editableDescription.jelly for loading the edit form.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:f="/lib/form" xmlns:l="/lib/layout">
   <j:if test="${it.class.name=='hudson.model.Hudson'}">
     <j:set var="it" value="${it.primaryView}"/>

core/src/main/resources/hudson/model/AbstractModelObject/editDescription.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   If JavaScript is off, this form is used to edit the description
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.displayName}" norefresh="true">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractModelObject/error.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <st:statusCode value="400" /><!-- clearly indicate that this page is an error page --> 
   <l:layout title="Jenkins">

core/src/main/resources/hudson/model/AbstractProject/BecauseOfUpstreamBuildInProgress/summary.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <st:structuredMessageFormat key="description">
     <st:structuredMessageArgument>

core/src/main/resources/hudson/model/AbstractProject/_api.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <st:include page="/hudson/model/Job/_api.jelly" />
 

core/src/main/resources/hudson/model/AbstractProject/changes.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Displays the console output
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${%changes.title(it.name)}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractProject/main.jelly

@@ -23,6 +23,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">
   <p:projectActionFloatingBox />
 

core/src/main/resources/hudson/model/AbstractProject/sidepanel.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Side panel for the project view.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:x="jelly:xml" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:header title="${it.name}">
     <st:include page="rssHeader.jelly" />

core/src/main/resources/hudson/model/AbstractProject/svn-password.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- show the icon legend -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractProject/wipeOutWorkspace.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- ask the user if he's ready to wipe out the workspace -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/AbstractProject/wipeOutWorkspaceBlocked.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- tell user that there's no workspace yet -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Actionable/actions.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Action list
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <t:actions />
 </j:jelly>
\ No newline at end of file

core/src/main/resources/hudson/model/AgentSlave/config.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
 	<f:entry title="${%launch command}">
 	  <f:textbox name="slave.command" value="${slave.command}"/>

core/src/main/resources/hudson/model/AllView/newViewDetail.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <div>
   ${%blurb}
 </div>
\ No newline at end of file

core/src/main/resources/hudson/model/AllView/noJob.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <div>
   <!--
     This is a good place to add "welcome" materials, like pointers to the website and etc

core/src/main/resources/hudson/model/Api/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
 	<l:layout title="Remote API">
 		<l:main-panel>

core/src/main/resources/hudson/model/BooleanParameterDefinition/config.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/BooleanParameterDefinition/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/BooleanParameterValue/value.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/BuildAuthorizationToken/config.jelly

@@ -27,6 +27,7 @@ THE SOFTWARE.
   Pseudo trigger configuration.
   Note that it is the object that owns BuildAuthorizationToken
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <j:if test="${app.useSecurity}">
     <f:optionalBlock name="pseudoRemoteTrigger"

core/src/main/resources/hudson/model/BuildTimelineWidget/control.jelly

@@ -21,6 +21,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <st:documentation>
     Show timeline trend image. It takes two builds

core/src/main/resources/hudson/model/Cause/UpstreamCause/description.jelly

@@ -21,6 +21,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
     <!-- upstreamUrl added in 1.284, so handle missing value -->
     <span>${it.upstreamUrl!=null ? "%started_by_project(it.upstreamProject,it.upstreamBuild.toString(),it.upstreamUrl,rootURL)" : it.shortDescription}</span>

core/src/main/resources/hudson/model/Cause/UserCause/description.jelly

@@ -21,6 +21,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
     <span>${%started_by_user(it.userName,rootURL)}</span>
 </j:jelly>

core/src/main/resources/hudson/model/Cause/description.jelly

@@ -21,6 +21,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
     <span>${it.shortDescription}</span>
 </j:jelly>

core/src/main/resources/hudson/model/CauseAction/summary.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <t:summary icon="orange-square.gif">
     <j:forEach var="entry" items="${it.causeCounts.entrySet()}">

core/src/main/resources/hudson/model/ChoiceParameterDefinition/config.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/ChoiceParameterDefinition/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/Computer/_api.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <h2>Load Statistics</h2>
   <p>

core/src/main/resources/hudson/model/Computer/_script.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Called from doScript() to display the execution result and the form.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <t:scriptConsole>
     <pre>println System.getenv("PATH")</pre>

core/src/main/resources/hudson/model/Computer/_scriptText.jelly

@@ -25,5 +25,6 @@ THE SOFTWARE.
 <!--
   Called from doScriptText() to display the execution result.
 -->
+<?jelly escape-by-default='false'?>
 <st:compress xmlns:j="jelly:core" xmlns:st="jelly:stapler">
 <st:contentType value="text/plain;charset=UTF-8" />${output}</st:compress>
\ No newline at end of file

core/src/main/resources/hudson/model/Computer/ajaxExecutors.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Used to asynchronously update executor queue
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <l:ajax>
     <t:executors computers="${h.singletonList(it)}" />

core/src/main/resources/hudson/model/Computer/builds.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.displayName}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Computer/configure.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Config page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout"
          xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout norefresh="true" permission="${it.CONFIGURE}" title="${%title(it.displayName)}">

core/src/main/resources/hudson/model/Computer/custom-jnlp.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.displayName}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Computer/delete.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
 		<st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Computer/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.displayName}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Computer/load-statistics.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.displayName} Load Statistics">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Computer/markOffline.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${%title(it.displayName)}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/Computer/nodepropertysummaries.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- display permalinks of the page -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler">
 	<!-- give properties a chance to contribute summary item -->
 	<j:forEach var="p" items="${app.globalNodeProperties}">

core/src/main/resources/hudson/model/Computer/sidepanel.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Side panel for a slave.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:header />
   <l:side-panel>

core/src/main/resources/hudson/model/ComputerSet/_new.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   2nd page in the "new slave" page for displaying the entire configuration entries for the selected job type.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout"
          xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <l:layout norefresh="true" permission="${app.ADMINISTER}">

core/src/main/resources/hudson/model/ComputerSet/configure.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Manage monitoring
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${%Node Monitoring Configuration}" norefresh="true">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/ComputerSet/index.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Entrance to the configuration page
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
 <l:layout title="${%Nodes}">
   <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/ComputerSet/new.jelly

@@ -29,6 +29,7 @@ THE SOFTWARE.
 
     new.jelly -> ComputerSet.doCreateItem -> _new2.jelly -> ComputerSet.doDoCreateItem
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <l:layout norefresh="true" permission="${app.ADMINISTER}">
     <st:include page="sidepanel.jelly" />

core/src/main/resources/hudson/model/ComputerSet/sidepanel.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Side panel
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:s="/lib/form">
   <l:header />
   <l:side-panel>

core/src/main/resources/hudson/model/Descriptor/newInstanceDetail.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <!--
     Used to render the description under a radio button in the "new job/computer/etc" page.

core/src/main/resources/hudson/model/DirectoryBrowserSupport/dir.jelly

@@ -23,6 +23,7 @@ THE SOFTWARE.
 -->
 
 <!-- Show files in the workspace -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.title} : ${path}">
     <st:include page="sidepanel.jelly" it="${it.owner}"/>
@@ -33,7 +34,7 @@ THE SOFTWARE.
           <form action="${backPath}" method="get">
             <a href="${topPath}"><img src="${imagesURL}/48x48/${icon}" class="rootIcon" alt="" height="48" width="48"/></a>
             <j:forEach var="p" items="${parentPath}">
-              <a href="${p.href}">${h.xmlEscape(p.title)}</a>
+              <a href="${p.href}">${p.title}</a>
               /
             </j:forEach>
             <input type="text" name="pattern" value="${pattern}" />
@@ -58,10 +59,10 @@ THE SOFTWARE.
                     
                       <j:choose>
                         <j:when test="${x.readable}">
-                          <a href="${t.href}">${h.xmlEscape(t.title)}</a>
+                          <a href="${t.href}">${t.title}</a>
                         </j:when>
                         <j:otherwise>
-                          ${h.xmlEscape(t.title)}
+                          ${t.title}
                         </j:otherwise>
                       </j:choose>
                       

core/src/main/resources/hudson/model/DownloadService/footer.jelly

@@ -29,6 +29,7 @@ THE SOFTWARE.
 
   This file is pulled into the layout.jelly
 -->
+<?jelly escape-by-default='false'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   ${it.generateFragment()}
 </j:jelly>

core/src/main/resources/hudson/model/Executor/causeOfDeath.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout title="${it.name}">
     <l:header />

core/src/main/resources/hudson/model/ExternalJob/newJobDetail.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <div>
   ${%body}
 </div>
\ No newline at end of file

core/src/main/resources/hudson/model/ExternalJob/sidepanel.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Side panel for the build view.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
 	<l:header title="${it.name}">
 	  <st:include page="rssHeader.jelly" />

core/src/main/resources/hudson/model/ExternalRun/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
 	<st:include page="console.jelly"/>
 </j:jelly>
\ No newline at end of file

core/src/main/resources/hudson/model/ExternalRun/sidepanel.jelly

@@ -25,6 +25,7 @@ THE SOFTWARE.
 <!--
   Side panel for the build view.
 -->
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:header title="${it.fullDisplayName}" />
   <l:side-panel>

core/src/main/resources/hudson/model/FileParameterDefinition/config.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/FileParameterDefinition/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/FileParameterValue/value.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define"
 	xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form"
 	xmlns:i="jelly:fmt" xmlns:p="/lib/hudson/project">

core/src/main/resources/hudson/model/Fingerprint/index.jelly

@@ -22,6 +22,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 -->
 
+<?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form" xmlns:i="jelly:fmt">
   <l:layout>
     <l:header title="${it.fileName}">