Skip to content

Fix XXE and XSS vulnerabilities#21

Open
bracketttc wants to merge 4 commits into
jenkinsci:masterfrom
bracketttc:vulnerability-patching
Open

Fix XXE and XSS vulnerabilities#21
bracketttc wants to merge 4 commits into
jenkinsci:masterfrom
bracketttc:vulnerability-patching

Conversation

@bracketttc
Copy link
Copy Markdown

Apply recommended fixes from OWASP Cheat Sheets to attempt to fix XXE and XSS vulnerabilities in Valgrind Plugin. Disables external entities and escapes all content used in the reports for HTML using Apache Commons Text escapeHtml4.

Fixes SECURITY-1829, SECURITY-1830

  • Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
  • Ensure that the pull request title represents the desired changelog entry
  • Please describe what you did
  • Link to relevant issues in GitHub or Jira
  • Link to relevant pull requests, esp. upstream and downstream changes
  • Ensure you have provided tests - that demonstrates feature works or fixes the issue

Copy link
Copy Markdown

@earlruby earlruby left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't have the rights to merge this, but the changes LGTM.

@renatosilvagaio
Copy link
Copy Markdown

Who can merge this? It would be very useful.

@Fischmiep
Copy link
Copy Markdown

I would love to see this as well. I think @eXistence would be the correct person.

@renatosilvagaio
Copy link
Copy Markdown

Can someone generate a new version with these changes and make available in Jenkins plugins?
It would be much appreciated.
@eXistence

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants