InjectedTest/JellyTestSuiteBuilder improperly determines whether an escape-by-default Jelly XML PI exists

[daniel-beck]

jenkins-test-harness/src/main/java/org/jvnet/hudson/test/JellyTestSuiteBuilder.java

Line 105 in 0622967

if (pi == null || !pi.getText().contains("escape-by-default")) {

is more lax than https://github.com/jenkinsci/jelly/blob/cb7966734f339619e5ee8e57b08009acbf5e1d10/src/java/org/apache/commons/jelly/parser/XMLParser.java#L800...L810, resulting in code passing the InjectedTest that doesn't actually affect Jelly behavior. See jenkinsci/android-emulator-plugin#207 for an example.

Since https://www.jenkins.io/blog/2018/10/10/security-updates/ this isn't letting a potential vulnerability slip through, as the only effect is potentially not disabling escape-by-default, but might still make for awkward to detect unexpected escaping behavior.