From e49f690939596acbc9a1be64128b2c7eaf91a6db Mon Sep 17 00:00:00 2001
From: Daniel Beck <daniel-beck@users.noreply.github.com>
Date: Wed, 29 Jul 2020 10:53:58 +0200
Subject: [PATCH 1/2] [SECURITY-1957]

---
 war/src/main/js/add-item.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/war/src/main/js/add-item.js b/war/src/main/js/add-item.js
index b82a94c610..762a6e64ae 100644
--- a/war/src/main/js/add-item.js
+++ b/war/src/main/js/add-item.js
@@ -59,7 +59,7 @@ $.when(getItems()).done(function(data) {
 
     function activateValidationMessage(messageId, context, message) {
       if (message !== undefined && message !== '') {
-        $(messageId, context).html('&#187; ' + message);
+        $(messageId, context).text('» ' + message);
       }
       cleanValidationMessages(context);
       hideInputHelp(context);

From 29c9a8fdeafe26fded955cfba188f50fd4f1786a Mon Sep 17 00:00:00 2001
From: Daniel Beck <daniel-beck@users.noreply.github.com>
Date: Wed, 29 Jul 2020 10:54:36 +0200
Subject: [PATCH 2/2] [SECURITY-1960]

---
 core/src/main/java/hudson/model/Cause.java    |  4 +--
 .../hudson/model/CauseSecurity1960Test.java   | 32 +++++++++++++++++++
 .../jobs/fs/builds/1/build.xml                | 28 ++++++++++++++++
 .../CauseSecurity1960Test/jobs/fs/config.xml  | 18 +++++++++++
 4 files changed, 80 insertions(+), 2 deletions(-)
 create mode 100644 test/src/test/java/hudson/model/CauseSecurity1960Test.java
 create mode 100644 test/src/test/resources/hudson/model/CauseSecurity1960Test/jobs/fs/builds/1/build.xml
 create mode 100644 test/src/test/resources/hudson/model/CauseSecurity1960Test/jobs/fs/config.xml

diff --git a/core/src/main/java/hudson/model/Cause.java b/core/src/main/java/hudson/model/Cause.java
index b6f120e211..818920d50e 100644
--- a/core/src/main/java/hudson/model/Cause.java
+++ b/core/src/main/java/hudson/model/Cause.java
@@ -486,12 +486,12 @@ public abstract class Cause {
         public String getShortDescription() {
             if(note != null) {
                 try {
-                    return Messages.Cause_RemoteCause_ShortDescriptionWithNote(addr, Jenkins.get().getMarkupFormatter().translate(note));
+                    return Messages.Cause_RemoteCause_ShortDescriptionWithNote(Util.xmlEscape(addr), Jenkins.get().getMarkupFormatter().translate(note));
                 } catch (IOException x) {
                     // ignore
                 }
             }
-            return Messages.Cause_RemoteCause_ShortDescription(addr);
+            return Messages.Cause_RemoteCause_ShortDescription(Util.xmlEscape(addr));
         }
         
         @Exported(visibility = 3)
diff --git a/test/src/test/java/hudson/model/CauseSecurity1960Test.java b/test/src/test/java/hudson/model/CauseSecurity1960Test.java
new file mode 100644
index 0000000000..b1be6d2036
--- /dev/null
+++ b/test/src/test/java/hudson/model/CauseSecurity1960Test.java
@@ -0,0 +1,32 @@
+package hudson.model;
+
+import org.junit.Assert;
+import org.junit.Rule;
+import org.junit.Test;
+import org.jvnet.hudson.test.Issue;
+import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.recipes.LocalData;
+import org.xml.sax.SAXException;
+
+import java.io.IOException;
+
+// TODO merge into CauseTest after release
+public class CauseSecurity1960Test {
+    @Rule
+    public JenkinsRule j = new JenkinsRule();
+
+    @Test
+    @Issue("SECURITY-1960")
+    @LocalData
+    public void xssInRemoteCause() throws IOException, SAXException {
+        final Item item = j.jenkins.getItemByFullName("fs");
+        Assert.assertTrue(item instanceof FreeStyleProject);
+        FreeStyleProject fs = (FreeStyleProject) item;
+        final FreeStyleBuild build = fs.getBuildByNumber(1);
+
+        final JenkinsRule.WebClient wc = j.createWebClient();
+        final String content = wc.getPage(build).getWebResponse().getContentAsString();
+        Assert.assertFalse(content.contains("Started by remote host <img"));
+        Assert.assertTrue(content.contains("Started by remote host &lt;img"));
+    }
+}
diff --git a/test/src/test/resources/hudson/model/CauseSecurity1960Test/jobs/fs/builds/1/build.xml b/test/src/test/resources/hudson/model/CauseSecurity1960Test/jobs/fs/builds/1/build.xml
new file mode 100644
index 0000000000..3e2d844937
--- /dev/null
+++ b/test/src/test/resources/hudson/model/CauseSecurity1960Test/jobs/fs/builds/1/build.xml
@@ -0,0 +1,28 @@
+<?xml version='1.1' encoding='UTF-8'?>
+<build>
+    <actions>
+        <hudson.model.CauseAction>
+            <causeBag class="linked-hash-map">
+                <entry>
+                    <hudson.model.Cause_-RemoteCause>
+                        <addr>&lt;img src=x onerror=alert(1)&gt;</addr>
+                        <note>note</note>
+                    </hudson.model.Cause_-RemoteCause>
+                    <int>1</int>
+                </entry>
+            </causeBag>
+        </hudson.model.CauseAction>
+    </actions>
+    <queueId>4</queueId>
+    <timestamp>1595937941553</timestamp>
+    <startTime>1595937941557</startTime>
+    <result>SUCCESS</result>
+    <duration>2</duration>
+    <charset>UTF-8</charset>
+    <keepLog>false</keepLog>
+    <builtOn></builtOn>
+    <workspace>/var/jenkins_home/workspace/fs</workspace>
+    <hudsonVersion>2.249</hudsonVersion>
+    <scm class="hudson.scm.NullChangeLogParser"/>
+    <culprits class="com.google.common.collect.EmptyImmutableSortedSet"/>
+</build>
\ No newline at end of file
diff --git a/test/src/test/resources/hudson/model/CauseSecurity1960Test/jobs/fs/config.xml b/test/src/test/resources/hudson/model/CauseSecurity1960Test/jobs/fs/config.xml
new file mode 100644
index 0000000000..087bf4e467
--- /dev/null
+++ b/test/src/test/resources/hudson/model/CauseSecurity1960Test/jobs/fs/config.xml
@@ -0,0 +1,18 @@
+<?xml version='1.1' encoding='UTF-8'?>
+<project>
+    <actions/>
+    <description></description>
+    <keepDependencies>false</keepDependencies>
+    <properties/>
+    <scm class="hudson.scm.NullSCM"/>
+    <canRoam>true</canRoam>
+    <disabled>false</disabled>
+    <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+    <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+    <authToken>test</authToken>
+    <triggers/>
+    <concurrentBuild>false</concurrentBuild>
+    <builders/>
+    <publishers/>
+    <buildWrappers/>
+</project>
\ No newline at end of file