Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-11930

Violations plugin does not properly escape HTML in code snippets

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Won't Fix
    • Icon: Major Major
    • violations-plugin
    • Jenkins 1.433, OpenJDK 1.6.0_20-b20

      Running jslint on JavaScript like this:

      var newTabDiv = '<div id="'+id+'"></div>';

      Produces HTML in the violations file display like this:

      <td class="pane" width="99%">Missing space between '<div id="' and '+'.</td></tr><tr><td class="pane">

      Which hoses the remainder of the page display, and is also probably a security issue. Actually the HTML from any of the violations pages fails the W3C validator spectacularly. But specifically, here the angle brackets and quotes in my code aren't being escaped (converted to HTML entities), which prevents the rest of the page from being displayed, and probably also lets anybody insert malicious code into your browser.

          [JENKINS-11930] Violations plugin does not properly escape HTML in code snippets

          Mark Waite added a comment -

          The violations plugin is deprecated. It has an unresolved security vulnerability. The last commit to the source code repository was over 7 years ago. Closing the issue as "Won't fix"

          Mark Waite added a comment - The violations plugin is deprecated. It has an unresolved security vulnerability. The last commit to the source code repository was over 7 years ago. Closing the issue as "Won't fix"

            peterkittreilly peterkittreilly
            jayqhacker Jay Hacker
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: