From ee59282ab6deaf75b81545c0b646209022da1a94 Mon Sep 17 00:00:00 2001
From: cnathe <cnathe@labkey.com>
Date: Mon, 22 Jun 2026 11:45:47 -0500
Subject: [PATCH] GitHub Kanban #1946: issues encoding of summary text
 resolution

---
 .../labkey/test/tests/issues/IssuesTest.java  | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/src/org/labkey/test/tests/issues/IssuesTest.java b/src/org/labkey/test/tests/issues/IssuesTest.java
index 440b80b618..557b2e10a5 100644
--- a/src/org/labkey/test/tests/issues/IssuesTest.java
+++ b/src/org/labkey/test/tests/issues/IssuesTest.java
@@ -750,6 +750,32 @@ public void duplicatesTest()
         assertTextPresent(String.format("Issue %s marked as duplicate of this issue.", issueIdB), "Duplicates");
     }
 
+    // GitHub Kanban #1946: verify encoding of resolution submitted on resolve
+    @Test
+    public void testResolutionEncodingInChangeSummary()
+    {
+        final String markerId = "testResolutionEncodingInChangeSummary";
+        // The Resolution dropdown won't accept arbitrary text, so we inject the payload into the <select> via JS below.
+        final String testResolution = "testRes<img src=\"x\" id=\"" + markerId + "\">";
+
+        DetailsPage detailsPage = _issuesHelper.addIssue("Resolution Encoding issue", NAME);
+
+        ResolvePage resolvePage = detailsPage.clickResolve();
+        // Force an arbitrary (un-allow-listed) resolution value onto the Resolution select and submit it
+        executeScript(
+                "var sel = document.getElementsByName('Resolution')[0];" +
+                "var opt = document.createElement('option');" +
+                "opt.value = arguments[0]; opt.text = arguments[0]; opt.selected = true;" +
+                "sel.add(opt); sel.value = arguments[0];",
+                testResolution);
+        detailsPage = resolvePage.save();
+
+        // verify that the resolution value is encoded in the summary text
+        assertElementNotPresent("Resolution was not HTML-encoded in the change-summary comment (stored XSS)",
+                Locator.id(markerId));
+        assertTextPresent(testResolution);
+    }
+
     @Test
     public void moveIssueTest()
     {