CVE-2018-1999007

@@ -877,9 +877,9 @@ void invoke(RequestImpl req, ResponseImpl rsp, Object node ) throws IOException,
             w.println("<p>Stapler processed this HTTP request as follows, but couldn't find the resource to consume the request");
             w.println("<pre>");
             EvaluationTrace.get(req).printHtml(w);
-            w.printf("<font color=red>-&gt; No matching rule was found on &lt;%s&gt; for \"%s\"</font>\n",node,req.tokens.assembleOriginalRestOfPath());
+            w.printf("<font color=red>-&gt; No matching rule was found on &lt;%s&gt; for \"%s\"</font>\n", escape(node.toString()), req.tokens.assembleOriginalRestOfPath());
             w.println("</pre>");
-            w.printf("<p>&lt;%s&gt; has the following URL mappings, in the order of preference:",node);
+            w.printf("<p>&lt;%s&gt; has the following URL mappings, in the order of preference:", escape(node.toString()));
             w.println("<ol>");
             MetaClass metaClass = webApp.getMetaClass(node);
             for (Dispatcher d : metaClass.dispatchers) {

@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2017, CloudBees, Inc
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * * Redistributions of source code must retain the above copyright notice, this
+ *   list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright notice,
+ *   this list of conditions and the following disclaimer in the documentation
+ *   and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+package org.kohsuke.stapler;
+
+import com.gargoylesoftware.htmlunit.WebClient;
+import com.gargoylesoftware.htmlunit.WebResponse;
+import java.net.URL;
+import javax.servlet.http.HttpServletResponse;
+import org.jvnet.hudson.test.For;
+import org.jvnet.hudson.test.Issue;
+import org.kohsuke.stapler.test.JettyTestCase;
+
+@For(Stapler.class) // but StaplerTest is not a JettyTestCase
+public class Stapler2Test extends JettyTestCase {
+
+    @Issue("SECURITY-390")
+    public void testTraceXSS() throws Exception {
+        WebClient wc = new WebClient();
+        wc.setThrowExceptionOnFailingStatusCode(false);
+        WebResponse rsp;
+        Dispatcher.TRACE = true;
+        try {
+            rsp = wc.getPage(new URL(this.url, "thing/<button>/x")).getWebResponse();
+        } finally {
+            Dispatcher.TRACE = false;
+        }
+        assertEquals(HttpServletResponse.SC_NOT_FOUND, rsp.getStatusCode());
+        String html = rsp.getContentAsString();
+        assertTrue(html, html.contains("&lt;button&gt;"));
+        assertFalse(html, html.contains("<button>"));
+    }
+    public Object getThing(String name) {
+        return name;
+    }
+
+}