search

jenkinsci / design-library-plugin

https://plugins.jenkins.io/design-library/
61 stars 76 forks source link

Tooltip docs need to explain Jenkins behavior changes #177

Open daniel-beck opened 2 years ago

daniel-beck commented 2 years ago

Describe your use-case which is not covered by existing documentation.

https://weekly.ci.jenkins.io/design-library/Tooltips/ does not mention that the behavior of tooltip has changed over time. As a result in invites developers to introduce XSS vulnerabilities in their code by letting them assume that tooltip has always behaved as documented.

Any plugin that is compatible with Jenkins before the introduction of html-tooltip needs to escape or sanitize content of tooltip.

Reference any relevant documentation, other materials or issues/pull requests that can be used for inspiration.

No response

uhafner commented 2 years ago

What is also missing: how can I make tooltips backward compatible: what needs to be done if I want to use HTML tooltips in Jenkins 2.380 and in the LTS 2.361.4? Should I use tooltip, html-tooltip, or data-html-tooltip? Or a mix?

timja commented 2 years ago

For backwards compatibility set both tooltip and data-html-tooltip. tooltip will be ignored if the html one is set on new versions