ExternalMergeCheck embeds html tags in merge check errors

[atikhono]

Reproducible in atlassian-external-hooks@master with Bitbucket Server 4.9.1. See the screenshot below. Obviously, happens because of https://github.com/ngsru/atlassian-external-hooks/blob/master/src/main/java/com/ngs/stash/externalhooks/hook/ExternalMergeCheckHook.java#L143. I've tested the code on Bitbucket 4.3, and it behaved as expected. Looks like they changed merge check errors rendering at some point of time between 4.3 and 4.9. I will make a pull request and remove the tags from MergeCheckHook, unless you suggest a better solution.

[atikhono]

@seletskiy @andreineculau what do you think?

[andreineculau]

nasty. I took a look at the release notes 4.3 to 4.9 and didn't see anything https://confluence.atlassian.com/bitbucketserver/bitbucket-server-4-9-release-notes-838535696.html but that doesn't fix the problem

I'd like to see atlassian respond to this on https://jira.atlassian.com/secure/Dashboard.jspa and then "fix" this plugin, so that everyone knows if this is a bug=regression, or if they indeed wanted to fix smth e.g. code injection. That said, I am not currently using stash/bitbucket 😈 so I won't file that bug myself.

I do think atlassian should provide a way for some markup e.g. markdown. Then this plugin could wrap in triple backticks to get a fixed-font look. I do know that without that markup, hooks that give proper=detailed output will just look awful given the size limits.

[atikhono]

@andreineculau There's a relevant task with some recent comments, indeed: https://jira.atlassian.com/browse/BSERV-4428 Let see what they tell us.

[pjohnson-ptc]

Hi All - we are experiencing this issue also while implementing external hooks in Atlassian Bitbucket -the message with the style being displayed (instead of actually interrupted / rendered ). Is the suggestion here that the responsibility to resolve this issue lay internally to Bitbucket Development ??

[atikhono]

@pjohnson-ptc The only thing we can do is patch ExternalMergeCheckHook to not insert any html tags into veto message until Atlassian fixes the Merge button UI. So far it's exactly how they've written in the bug I mentioned up there. The detailed message is added as a title attribute of the merge button if it is the only message and as such can't contain any HTML. If there's more than one veto message, the title goes something hardcoded like 'Merge cannot be performed' with the list of messages in the merge button pop-up.

[mgwoj]

The problem in Bitbucket is not resolved. Can you please remove HTML formatting in the meantime? It is not helping at all with current versions of BB.

[rumpelstiltzkin]

Bump. Can you please remove the HTML formatting?

[seletskiy]

No HTML formatting is done ATM.