[visualforce] Add test for VfUnescapeEl with $MessageChannel

docs/pages/release_notes.md

@@ -18,10 +18,14 @@ This is a {{ site.pmd.release_type }} release.
 
 *   apex-bestpractices
     *   [#2626](https://github.com/pmd/pmd/issues/2626): \[apex] UnusedLocalVariable - false positive on case insensitivity allowed in Apex
+*   apex-security
+    *   [#2620](https://github.com/pmd/pmd/issues/2620): \[visualforce] False positive on VfUnescapeEl with new Message Channel feature
 
 ### API Changes
 
 ### External Contributions
 
+*   [#2621](https://github.com/pmd/pmd/pull/2621): \[visualforce] add new safe resource for VfUnescapeEl - [Peter Chittum](https://github.com/pchittum)
+
 {% endtocmaker %}
 

pmd-visualforce/src/test/resources/net/sourceforge/pmd/lang/vf/rule/security/xml/VfUnescapeEl.xml

@@ -537,4 +537,17 @@
 <a onclick="openTab({!HTMLENCODE('/apex/Download?redirectUrl=' + downloadURL)}', 'test');">
         ]]></code>
     </test-code>
+
+    <test-code>
+        <description>Support new message channel feature #2620</description>
+        <expected-problems>0</expected-problems>
+        <code><![CDATA[
+<script type="text/javascript">
+    // Binding message channel to variable accessible to static resource.
+    window.util = {
+        messageChannel: '{!$MessageChannel.Record_Selected__c}'
+    };
+</script>
+        ]]></code>
+    </test-code>
 </test-data>