Autodesk / Autodesk/jenkinsci-benchmark-plugin
Xml external entity injection vulnerability
- Dominant language
- Java
- Stars
- 6
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
Hello, the getxml() method in FormatSelector.java is used to parse the xml string，But because the xml parser does not disable the xml external entity, it causes the xxe vulnerability.
The same problem exists in line 201 of MapXmlToPlugin.java.
Contributor guide
Research direction
Start by reading getxml() in FormatSelector.java and the XML parsing code around line 201 of MapXmlToPlugin.java. Trace how each method configures its parser, then verify that externally defined entities are no longer processed in both locations; check the repository for relevant XML parsing tests before adding or running coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100