Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
jenkinsci/coverage-plugin
main @ a04d3e3
3
Fixes
0
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Deserialization: 1 prior fix. Scrutinize any change in this area.
plugin/src/main/java/io/jenkins/plugins/coverage/metrics/steps/CoverageQualityGate.java: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Deserialization: Unsafe deserialization of arbitrary objects can lead to remote code execution (RCE) on the master or agent nodes. The implementation of CompatibleObjectInputStream required a strict Remoting ClassFilter to safely validate classes during deserialization. Future developers must reuse standard Jenkins deserialization utilities or strictly enforce class filtering on custom ObjectInputStream implementations.
Reflected XSS: Insecure handling of dynamic properties in Jelly templates allows attackers to inject malicious scripts into the coverage report views. This vulnerability stemmed from rendering unescaped dynamic variables. All dynamically rendered properties must be processed through explicit output encoding or secure taglibs.
Missing Authorization: Stapler web-bound data filling methods lacked proper permissions, exposing system configuration items to unauthorized users. Explicit permission checks (e.g., Jenkins.READ) must be declared and verified within all UI bound dropdown or auto-completion methods to prevent information exposure.