Language: Java
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public void shouldEscapeRenderedPipelineLabels() {
        Document actualDoc = parser.parseInput(view.render(createJobDetailModel()), "");

        // Header is escaped
        assertThat(actualDoc.select("#job_details_header").last().html())
            .contains(StringEscapeUtils.escapeHtml4(DODGY_LABEL));

        // Sidebar links are escaped
        assertThat(actualDoc.select("#buildlist-container ul li[id=build_list_1]").last().html())
            .contains(String.format("pipeline/%s/stage/1/job", StringEscapeUtils.escapeHtml4(DODGY_LABEL)));

        // Strange JS that updates sidebar should be correctly JS escaped
        assertThat(actualDoc.select("#build_history_holder script").last().html())
            .contains("json_to_css.update_build_list(eval({\"building_info\"")
            .contains(String.format("\"buildLocatorForDisplay\":\"pipeline/%s/stage/1/job\"", DODGY_LABEL_UNICODE_ESCAPED));
    }