Skip to content

Fix XXE and XSS vulnerabilities #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bracketttc wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Fix XXE and XSS vulnerabilities #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5c5a24c
Use https in URIs
bracketttc Jul 30, 2021
b658eac
Remove illegal <> chars in doc comments
bracketttc Jul 30, 2021
531a61b
Prevent XXE
bracketttc Jul 29, 2021
52392cc
Escape input from Valgrind XML to avoid XSS
bracketttc Jul 30, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
<version>0.29-SNAPSHOT</version>
<packaging>hpi</packaging>
<name>Jenkins Valgrind Plug-in</name>
<url>http://wiki.jenkins-ci.org/display/JENKINS/Valgrind+Plugin</url>
<url>https://wiki.jenkins-ci.org/display/JENKINS/Valgrind+Plugin</url>

<licenses>
<license>
Expand All @@ -37,14 +37,14 @@
<repositories>
<repository>
<id>repo.jenkins-ci.org</id>
<url>http://repo.jenkins-ci.org/public/</url>
<url>https://repo.jenkins-ci.org/public/</url>
</repository>
</repositories>

<pluginRepositories>
<pluginRepository>
<id>repo.jenkins-ci.org</id>
<url>http://repo.jenkins-ci.org/public/</url>
<url>https://repo.jenkins-ci.org/public/</url>
</pluginRepository>
</pluginRepositories>

Expand All @@ -62,6 +62,11 @@
<scope>test</scope>
</dependency>

<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-text</artifactId>
<version>1.3</version>
</dependency>
<dependency>
<groupId>org.easymock</groupId>
<artifactId>easymock</artifactId>
Expand Down
2 changes: 1 addition & 1 deletion src/main/java/org/jenkinsci/plugins/valgrind/ValgrindResult.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@ public String getSummary() throws IOException, InterruptedException

/**
*
* @param link expected to be in format "id=<executable name>,<unique error id>"
* @param link expected to be in format "id=&lt;executable name&gt;,&lt;unique error id&gt;"
* @param request
* @param response
* @return valgrind detail(s)
Expand Down
7 changes: 6 additions & 1 deletion src/main/java/org/jenkinsci/plugins/valgrind/parser/ValgrindSaxParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;

import static org.apache.commons.text.StringEscapeUtils.escapeHtml4;

import org.jenkinsci.plugins.valgrind.model.ValgrindAuxiliary;
import org.jenkinsci.plugins.valgrind.model.ValgrindError;
import org.jenkinsci.plugins.valgrind.model.ValgrindErrorKind;
Expand Down Expand Up @@ -329,7 +331,7 @@ public void characters(char ch[], int start, int length) throws SAXException
if ( data == null )
return;

data.append(new String(ch,start,length));
data.append(escapeHtml4(new String(ch,start,length)));
}

public ValgrindReport getReport()
Expand All @@ -342,6 +344,9 @@ public ValgrindReport parse( final File file ) throws ParserConfigurationExcepti
{
SAXParserFactory factory = SAXParserFactory.newInstance();
factory.setNamespaceAware(true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
SAXParser saxParser = factory.newSAXParser();

Handler handler = new Handler();
Expand Down
2 changes: 1 addition & 1 deletion src/test/java/org/jenkinsci/plugins/valgrind/parser/ValgrindSaxParserTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,7 +175,7 @@ public void suppression() throws ParserConfigurationException, SAXException, IOE

final String expectedSuppression =
"{\n" +
" <insert_a_suppression_name_here>\n" +
" insert_a_suppression_name_here\n" +
" Memcheck:Addr1\n" +
" fun:memcpy@@GLIBC_2.14\n" +
" fun:access_already_freed_memory_memcpy\n" +
Expand Down
2 changes: 1 addition & 1 deletion src/test/resources/org/jenkinsci/plugins/valgrind/parser/aux-data.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,7 +87,7 @@
<rawtext>
<![CDATA[
{
<insert_a_suppression_name_here>
insert_a_suppression_name_here
Memcheck:Addr1
fun:memcpy@@GLIBC_2.14
fun:access_already_freed_memory_memcpy
Expand Down