Autodesk / Autodesk/jenkinsci-benchmark-plugin
Missing XML Validation
Open
- Dominant language
- Java
- Stars
- 6
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/Autodesk/jenkinsci-benchmark-plugin/blob/adaec62a61b96b851677733bbebda03db9a017b9/src/main/java/org/jenkinsci/plugins/benchmark/parsers/FormatSelector.java#L365
Failure to enable validation when parsing XML gives an attacker the opportunity to supply malicious input.
Contributor guide
Research direction
Start in src/main/java/org/jenkinsci/plugins/benchmark/parsers/FormatSelector.java at line 365 and trace how XML input is parsed. Confirm the parser's validation behavior and verify that malicious XML input is rejected when the issue is resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100