Jelly Tag replace HTML Tag

Question

I am trying to replace some value with a HTML tag with jelly.

But it seems that jelly doesn't like to use greater than or less than as replacement without any escaping.

Escaping to < is not what I want, because in this way the HTML tag will not work anymore..

<util:replace new="<span>" old="replaceme" value="${somevar}" var="somevar" />

How do I escape a HTML-Tag e.g. like <span> in jelly?

Answer 1

For Jelly templates (e.g. in Jenkins email-ext plugin), it is strongly recommended to use <?jelly escape-by-default='true'?> on top of the jelly file, to prevent cross-site scripting vulnerabilities.

But if you need to print HTML mark up characters like '<', then wrap it with <j:out>. For example, here's how to disable escaping of <a> href (in a change-set message):

<j:out value="${changeSet.msgAnnotated}"/>