Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-11098

Ansicolor Plugin makes console output view vulnerable to XSS attacks

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Major Major
    • plugin-proposals
    • None

      The plugin has a problem with XSS code.

      Just create a buildjob that executes the following shell command and have ansicolor enabled.
      echo -e "\e[1;94m test<script>var xss = function()

      { alert('not good');}

      ; xss();</script>"
      It needs the special char which seems to get filtered in Jira.

            Unassigned Unassigned
            kelfenbein Karsten Elfenbein
            Votes:
            1 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: