From eeeda9eea834966fb0e3ce81b161afd8a53d68e3 Mon Sep 17 00:00:00 2001
From: Seiji Sogabe <s.sogabe@gmail.com>
Date: Tue, 28 Dec 2010 23:44:39 +0900
Subject: [PATCH] [FIXED HUDSON-8270] escape quotes.

---
 core/src/main/java/hudson/Util.java     | 6 ++++++
 core/src/test/java/hudson/UtilTest.java | 7 +++++++
 2 files changed, 13 insertions(+)

diff --git a/core/src/main/java/hudson/Util.java b/core/src/main/java/hudson/Util.java
index dbd8b9107b..b7d76ca56a 100644
--- a/core/src/main/java/hudson/Util.java
+++ b/core/src/main/java/hudson/Util.java
@@ -807,6 +807,12 @@ public class Util {
             if(ch=='&')
                 buf.append("&amp;");
             else
+            if(ch=='"')
+                buf.append("&quot;");
+            else
+            if(ch=='\'')
+                buf.append("&#039;");
+            else
             if(ch==' ') {
                 // All spaces in a block of consecutive spaces are converted to
                 // non-breaking space (&nbsp;) except for the last one.  This allows
diff --git a/core/src/test/java/hudson/UtilTest.java b/core/src/test/java/hudson/UtilTest.java
index a3fc4d9b4a..f331aa5fb8 100644
--- a/core/src/test/java/hudson/UtilTest.java
+++ b/core/src/test/java/hudson/UtilTest.java
@@ -170,4 +170,11 @@ public class UtilTest extends TestCase {
             Util.deleteRecursive(d);
         }
     }
+
+    public void TestEscape() {
+        assertEquals("<br>", Util.escape("\n"));
+        assertEquals("&lt;a>", Util.escape("<a>"));
+        assertEquals("&quot;&#039;", Util.escape("'\""));
+        assertEquals("&nbsp; ", Util.escape("  "));
+    }
 }
-- 
GitLab