Repository navigation
Conversation
mnsboev
approved these changes
Oct 19, 2026
The evidence summary table interpolated the subject display name, predicate slug/type and evidence URL into HTML without escaping. These values come from the Evidence service create response, so they could add rows, links or images to the GitHub job summary. Values are now HTML-escaped and line breaks are replaced with spaces, so a value cannot end the HTML block. The subject is linked only when the evidence URL has an http or https scheme.
alenon
force-pushed
the
bugfix/RTDEV-102807-escape-evidence-summary
branch
from
October 19, 2026 13:18
7ff4b13 to
983a40a
Compare
This branch is waiting to be deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
The evidence job summary (
artifactory/utils/commandsummary/evidencesummary.go) built its HTML table withfmtinterpolation and no escaping. The subject display name, predicate slug, predicate type and evidence URL went into<td>cells and an<a href>. The predicate slug and type come from the Evidence service create response, which jfrog-cli-evidence records andjf summaryrenders into the GitHub job summary.All interpolated values now go through one helper, which HTML-escapes them and replaces
\r/\nwith spaces. A blank line would end the GFM HTML block, and the rest would then be parsed as Markdown. The subject is linked only when the evidence URL has anhttporhttpsscheme; otherwise it is shown as plain text.The evidence golden files change only in the
hrefquery string, where&is now written as&. The rendered link is the same.jfrog-cli-evidence also validates these fields before recording them: jfrog/jfrog-cli-evidence#97.
jf summaryruns in jfrog-cli, so it picks up this change with the next jfrog-cli-core dependency bump there.