Closed mig42 closed 3 months ago
This PR dismisses some security alerts about using potentially unsafe classes:
They're warning about the usage of org.apache.commons.digester3.Digester, which has uses org.xml.sax.XMLReader underneath and it's therefore vulnerable to XML eXternal Entity injection (XXE).
org.apache.commons.digester3.Digester
org.xml.sax.XMLReader
The plugin builds the Digester via DigesterUtils, which already applies the protections in https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlreader .
Digester
DigesterUtils
We can safely dismiss this alerts, as we're already protecting our XML readers.
Not needed. This PR only adds @SuppressWarnings annotations.
@SuppressWarnings
This PR dismisses some security alerts about using potentially unsafe classes:
They're warning about the usage of
org.apache.commons.digester3.Digester
, which has usesorg.xml.sax.XMLReader
underneath and it's therefore vulnerable to XML eXternal Entity injection (XXE).The plugin builds the
Digester
viaDigesterUtils
, which already applies the protections in https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#xmlreader .We can safely dismiss this alerts, as we're already protecting our XML readers.
Testing done
Not needed. This PR only adds
@SuppressWarnings
annotations.Submitter checklist