jenkinsci/multiple-scms-plugin — pull request #2 by jhansche (2012-08-01 20:36:01+00:00)
Title: Fix potential SAX parser error

Fixes https://issues.jenkins-ci.org/browse/JENKINS-14537

The plugin makes use of string concatenation in order to build the XML file (using `<%s scm=\"%s\">\n%s\n\n` as a pattern to fill in plain Strings). But then the plugin makes use of a SAX parser to parse the results. Because the original XML file was not created using a proper XML generator, the result cannot be assumed to be properly formatted XML.

The simple test is to have a commit that simply includes the string "`]]>`". The result will be that there are no new commits listed in the change log, and a *huge* stack trace dumped to the Jenkins log file.

In order to maintain backward compatibility (e.g., so it doesn't inadvertently decode entities from previous version of the plugin), it will only attempt the conversion if the {{}} node contains the {{version="2"}} attribute.