jenkinsci / plasticscm-plugin

A plugin for Jenkins to be able to use Plastic SCM
MIT License
15 stars 31 forks source link

Dismiss unsafe class alerts about org.apache.commons.digester3.Digester #77

Closed mig42 closed 3 months ago

mig42 commented 3 months ago

This PR dismisses some security alerts about using potentially unsafe classes:

They're warning about the usage of org.apache.commons.digester3.Digester, which has uses org.xml.sax.XMLReader underneath and it's therefore vulnerable to XML eXternal Entity injection (XXE).

The plugin builds the Digester via DigesterUtils, which already applies the protections in https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlreader .

We can safely dismiss this alerts, as we're already protecting our XML readers.

Testing done

Not needed. This PR only adds @SuppressWarnings annotations.

Submitter checklist