From 558d12603f2a4c51ecb7712e99ca00c73f862eab Mon Sep 17 00:00:00 2001 From: iland Date: Sun, 12 Aug 2018 11:41:14 +0300 Subject: [PATCH] bugid: added security fix CR_By: n/a --- src/main/java/com/checkmarx/jenkins/CxScanBuilder.java | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/main/java/com/checkmarx/jenkins/CxScanBuilder.java b/src/main/java/com/checkmarx/jenkins/CxScanBuilder.java index c7690f18..44ab63f5 100644 --- a/src/main/java/com/checkmarx/jenkins/CxScanBuilder.java +++ b/src/main/java/com/checkmarx/jenkins/CxScanBuilder.java @@ -37,6 +37,7 @@ import org.apache.commons.io.FileUtils; import org.apache.commons.io.IOUtils; import org.apache.commons.lang.StringUtils; +import org.apache.commons.lang3.StringEscapeUtils; import org.jetbrains.annotations.NotNull; import org.jetbrains.annotations.Nullable; import org.kohsuke.stapler.*; @@ -1483,7 +1484,7 @@ public ListBoxModel doFillPresetItems(@QueryParameter final boolean useOwnServer // timestamp is not used in code, it is one of the arguments to invalidate Internet Explorer cache ListBoxModel listBoxModel = new ListBoxModel(); try { - CxCredentials credentials = CxCredentials.resolveCredentials(!useOwnServerCredentials, serverUrl, username, getPasswordPlainText(password), credentialsId, this, item); + CxCredentials credentials = CxCredentials.resolveCredentials(!useOwnServerCredentials, serverUrl, username, StringEscapeUtils.escapeHtml4(getPasswordPlainText(password)), credentialsId, this, item); CxShragaClient shragaClient = prepareLoggedInClient(credentials); //todo import preset @@ -1526,7 +1527,7 @@ public ListBoxModel doFillSourceEncodingItems(@QueryParameter final boolean useO ListBoxModel listBoxModel = new ListBoxModel(); try { - CxCredentials credentials = CxCredentials.resolveCredentials(!useOwnServerCredentials, serverUrl, username, getPasswordPlainText(password), credentialsId, this, item); + CxCredentials credentials = CxCredentials.resolveCredentials(!useOwnServerCredentials, serverUrl, username, StringEscapeUtils.escapeHtml4(getPasswordPlainText(password)), credentialsId, this, item); CxShragaClient shragaClient = prepareLoggedInClient(credentials); List configurationList = shragaClient.getConfigurationSetList(); @@ -1556,7 +1557,7 @@ public ListBoxModel doFillGroupIdItems(@QueryParameter final boolean useOwnServe // timestamp is not used in code, it is one of the arguments to invalidate Internet Explorer cache ListBoxModel listBoxModel = new ListBoxModel(); try { - CxCredentials credentials = CxCredentials.resolveCredentials(!useOwnServerCredentials, serverUrl, username, getPasswordPlainText(password), credentialsId, this, item); + CxCredentials credentials = CxCredentials.resolveCredentials(!useOwnServerCredentials, serverUrl, username, StringEscapeUtils.escapeHtml4(getPasswordPlainText(password)), credentialsId, this, item); CxShragaClient shragaClient = prepareLoggedInClient(credentials); List teamList = shragaClient.getTeamList();