[JENKINS-60866][JENKINS-71515] Use JSON#parse to process codemirror-config argument

core/src/main/java/hudson/markup/MarkupFormatter.java

@@ -62,9 +62,14 @@
  * This is an extension point in Hudson, allowing plugins to implement different markup formatters.
  *
  * <p>
- * Implement the following methods to enable and control CodeMirror syntax highlighting
- * public String getCodeMirrorMode() // return null to disable CodeMirror dynamically
- * public String getCodeMirrorConfig()
+ * Implement the following methods to enable and control CodeMirror syntax highlighting:
+ * <ul>
+ *     <li><code>public String getCodeMirrorMode()</code> (return <code>null</code> to disable CodeMirror dynamically)</li>
+ *     <li>
+ *         <code>public String getCodeMirrorConfig()</code> (JSON snippet without surrounding curly braces, e.g., <code>"mode": "text/css"</code>.
+ *         Historically this allowed invalid JSON, but since TODO it needs to be properly quoted etc.
+ *     </li>
+ * </ul>
  *
  * <h2>Views</h2>
  * <p>

core/src/main/resources/hudson/tasks/Shell/config.groovy

@@ -25,7 +25,7 @@ package hudson.tasks.Shell
 f=namespace(lib.FormTagLib)
 
 f.entry(title:_("Command"),description:_("description",rootURL)) {
-    f.textarea(name: "command", value: instance?.command, class: "fixed-width", 'codemirror-mode': 'shell', 'codemirror-config': "mode: 'text/x-sh'")
+    f.textarea(name: "command", value: instance?.command, class: "fixed-width", 'codemirror-mode': 'shell', 'codemirror-config': '"mode": "text/x-sh"')
 }
 
 f.advanced() {

core/src/main/resources/lib/form/textarea/textarea.js

@@ -3,7 +3,28 @@ Behaviour.specify("TEXTAREA.codemirror", "textarea", 0, function (e) {
   if (!config) {
     config = "";
   }
-  config = eval("({" + config + "})");
+  try {
+    config = JSON.parse("{" + config + "}");
+  } catch (ex) {
+    /*
+     * Attempt to parse fairly common legacy format whose exact content is:
+     * mode:'<MIME>'
+     */
+    let match = config.match("^mode: ?'([^']+)'$");
+    if (match) {
+      console.log(
+        "Parsing simple legacy codemirror-config value using fallback: " +
+          config
+      );
+      config = { mode: match[1] };
+    } else {
+      console.log(
+        "Failed to parse codemirror-config '{" + config + "}' as JSON",
+        ex
+      );
+      config = {};
+    }
+  }
   if (!config.onBlur) {
     config.onBlur = function (editor) {
       editor.save();