Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

javaee/javaee-jsp-api

              master @ 1692d5b
            

Fixes

CVEs

HIGH

Peak severity

0.0%

Coverage

Highlights

Log Injection: 1 prior fix. Scrutinize any change in this area.

impl/src/main/java/org/apache/jasper/runtime/JspRuntimeLibrary.java: most-fixed (1 issue). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Privilege Escalation: Unsafe execution of code blocks inside AccessController.doPrivileged can allow untrusted JSP code or callers to escalate privileges under a SecurityManager. Future property introspection helper modifications must strictly avoid executing untrusted operations inside privileged blocks.

XXE: Unconfigured XML parsers will resolve external entities, exposing the container to server-side request forgery (SSRF) and local file disclosure. All XML parsing utilities must explicitly disable external entity resolution by default.

Log Injection: Logging unvalidated HTTP request paths directly allows attackers to inject carriage returns and line feeds (CRLF), corrupting log integrity and spoofing log entries. All request metadata must be sanitized and length-limited prior to logging.