[JENKINS-20312] Gerrit Trigger plugin does not correctly escape content of file provided as "Unsuccessful Message File"

A text file can be defined in the "Custom Build Messages" section of the Gerrit Trigger plugin, whose content is provided to Gerrit as an error message. The content of this file is, however, not escaped correctly, and can cause failures when the gerrit-review command is executed.

Specifically, single quotes are not escaped. As an example, use the following text as part of the message file (the dashed lines delimit the file, but are not part of it):

--------------------------------

test

this ' is ' a ' test

test

--------------------------------

The gerrit-review command will fail because the content of the second line will be provided to Gerrit as separate parameters.

---
Originally reported by dark, imported from: Gerrit Trigger plugin does not correctly escape content of file provided as "Unsuccessful Message File"

• assignee: rsandell
  
• status: Open
  
• priority: Major
  
• component(s): gerrit-trigger-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-06
  

Raw content of original issue

A text file can be defined in the "Custom Build Messages" section of the Gerrit Trigger plugin, whose content is provided to Gerrit as an error message. The content of this file is, however, not escaped correctly, and can cause failures when the gerrit-review command is executed.


Specifically, single quotes are not escaped. As an example, use the following text as part of the message file (the dashed lines delimit the file, but are not part of it):


--------------------------------

test

this ' is ' a ' test

test

--------------------------------


The gerrit-review command will fail because the content of the second line will be provided to Gerrit as separate parameters.

Start at the Gerrit Trigger plugin's Custom Build Messages handling and the gerrit-review command invocation described in the report. Reproduce the failure with a message containing single quotes, then verify that the complete message is passed as one valid error message without command failures.

Written by the indexing model from the issue text.