[SECURITY-2220] Escape plot description

[offa]

Naive approach to address SECURITY-2220.

<j:out … /> seems to ignore escape-by-default, using a simple <span>…</span> instead escapes the value.

@Wadeck @daniel-beck

What has been done

1. Escaping added to prevent a security issue

How to test

1. Use Plot description that needs escaping

Checklist

• Git commits follow best practices
• Build passes in Jenkins
• Appropriate tests or explanation to why this change has no tests
• Pull Request is marked with appropriate label (see .github/release-drafter.yml)
• JIRA issue is well described (problem explanation, steps to reproduce, screenshots)
• For dependency updates: links to external changelogs and, if possible, full diffs

[Wadeck]

Not manually tested but that's the kind of correction that was expected 👍

[offa]

Now, how to continue from here?

[Wadeck]

Manually tested:

It's working as expected, great job.

---

Next step:

• @ericbn merge and release this plugin (alternative option, someone else requests to become a maintainer to do it)
• someone proposes a PR to update https://github.com/jenkins-infra/update-center2/blob/master/resources/warnings.json#L13029-L13041

[daniel-beck]

Doesn't even need the span.

              <b>Description</b>: ${it.getPlotDescription(index)}

would do it.

Note that j:out specifically disables the effect of escape-by-default and prints it verbatim. (Its counterpart st:out always escapes what's printed, luckily there's no chance of anyone ever confusing the two 😫 .)

[offa]

@ericbn could you consider a new release so we can install a fixed version please?

[offa]

@ericbn @timja please create a new release, the security issue is still open for Jenkins instances around.

[timja]

I am not a maintainer of plot

[ericbn]

Version 2.1.11 released.