Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions core/src/main/resources/lib/form/helpLink.jelly
Original file line number Diff line number Diff line change
Expand Up @@ -29,12 +29,12 @@ THE SOFTWARE.
a spacer if none is available.

The help link is rendered as a table cell with an (?) icon.
If the user clicks it, the content of the HTML fragment at the given URL
If the user clicks it, the content of the HTML fragment at the given URL
is rendered in the area designated as <f:helpArea> by the caller,
usually in a row beneath the item with help.

The alternative spacer is just an empty table cell.

This tag was introduced to ensure that the space reserved for help items
is consistent over the UI whether or not help exists.

Expand All @@ -49,14 +49,14 @@ THE SOFTWARE.
]]>
</st:attribute>
<st:attribute name="featureName">
Name of the feature described by the help text, used for constructing the
Name of the feature described by the help text, used for constructing the
icon's alt attribute. Optional.
</st:attribute>
</st:documentation>
<j:choose>
<j:when test="${attrs.url!=null}">
<j:set var="altText" value="${attrs.featureName != null ? '%Help for feature:' + ' ' + attrs.featureName : '%Help'}" />
<a href="#" class="jenkins-help-button" tooltip="${altText}" helpURL="${rootURL}${attrs.url}">
<a href="#" class="jenkins-help-button" aria-label="${altText}" helpURL="${rootURL}${attrs.url}">
<!-- .jenkins-help-button span element is required as it's restyled in CSS -->
<span>?</span>
</a>
Expand Down
14 changes: 3 additions & 11 deletions test/src/test/java/jenkins/security/Security2779Test.java
Original file line number Diff line number Diff line change
Expand Up @@ -28,19 +28,11 @@ void setUp(JenkinsRule rule) {
j = rule;
}

@Test
void noXssInHelpLinkPanel() throws Exception {
noCrossSiteScriptingInHelp("#link-panel a");
}

@Test
void noXssInHelpIconPanel() throws Exception {
noCrossSiteScriptingInHelp("#icon-panel svg");
}

private void noCrossSiteScriptingInHelp(String selector) throws Exception {
final AtomicInteger alerts = new AtomicInteger();
final JenkinsRule.WebClient webClient = j.createWebClient();
var selector = "#icon-panel svg";
var alerts = new AtomicInteger();
var webClient = j.createWebClient();
webClient.setAlertHandler((AlertHandler) (p, s) -> alerts.addAndGet(1));
final HtmlPage page = webClient.goTo(URL_NAME);
page.executeJavaScript("document.querySelector('" + selector + "')._tippy.show()");
Expand Down
Loading