search

jenkinsci / fortify-plugin

Fortify Jenkins plugin
https://plugins.jenkins.io/fortify
Other
23 stars 29 forks source link

Remove the prototype from Fortify plugin #70

Closed akaryakina closed 10 months ago

akaryakina commented 10 months ago

This is to remove usages of Prototype from the Fortify plugin to address #64

I tested this locally with the latest Jenkins LTS version with a user that has Prototype disabled.

I'm asking if anyone could code review the changes since I'm not a javascript expert.

github-advanced-security[bot] commented 10 months ago

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

akaryakina commented 10 months ago

@basil Thank you SO MUCH for looking at the code! Yes, the POST parameters were exactly the item that bothered me, and I am very grateful to you for spending your time. It is really not a good idea to expose parameters this way for a security plugin, even though they are not supposed to be passing any sensitive information. But when we pass a piece of text that the user might have typed in a form, we could accidentally expose private information and just make it easier for everyone to collect it. As for the javax -> jakarta, that's a very good idea, indeed. I'll try to modify that to a plugin dependency as soon as I am able to update the minimal required jenkins version.