lp:~james-page/ubuntu/oneiric/jenkins-winstone/fix-xss

Branch merges

Propose for merging

No branches dependent on this one.

Related source package recipes

No recipes using this branch. (?)

Create packaging recipe

Related snap packages

Related bugs

Bug #889181: XSS vulnerability in Jenkins error pages when running in standalone mode

High

Fix Released

Link a bug report

Related blueprints

5. By James Page on 2011-11-22

SECURITY UPDATE: XSS vulnerability in default error pages (LP: #889181).

4. By James Page on 2011-11-22

* SECURITY UPDATE: XSS vulnerability in default error pages.
  - debian/patches/fix_xss.patch: escape error messages which are supposed
    be plain text and not markup in
    src/java/winstone/ErrorServlet.java,
    src/java/winstone/URIUtil.java,
    src/java/winstone/WinstoneResponse.java
  - http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2011-11-08.cb
* d/maven.{properties,ignoreRules}: Disabled testing as htmlunit is
  currently broken in 11.10.

3. By James Page on 2011-08-18

* Support offline validation of XML configuration files (LP: #827651):
  - debian/patches/specification-resources.patch: CDDL/GPL-2 licensed
    xsd+DTD resources for all servlet, jsp and j2ee specifications.
  - debian/copyright: documented copyright + license for
    specification-resources.patch.
  - debian/control: Removed dependency on libservlet2.5-java, no longer
    required.
  - debian/patches/series,debian/patches/use_system_servletapi.patch:
    Dropped patch as no longer required.
  - debian/libjenkins-winstone-java.classpath: Dropped as all required
    resources are now included in winstone.

2. By James Page on 2011-06-29

Initial release

1. By James Page on 2011-06-29

Import upstream version 0.9.10-jenkins-25+dfsg