Skip to content

Conversation

@aalsanie
Copy link

@psiinon
Copy link
Member

psiinon commented Dec 22, 2025

Logo
Checkmarx One – Scan Summary & Details9f90fb19-1e99-4349-a0a1-d41b1be0551a

New Issues (1)

Checkmarx found the following issues in this Pull Request

Severity Issue Source File / Package Checkmarx Insight
HIGH Improper_Restriction_of_Stored_XXE_Ref /subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApiMain.java: 214
detailsThe loads and parses XML using parse, at line 213 of /subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/AlertsFile.java. This...
ID: zW%2BiHctL%2BM4CHztLxV8BSEwlXZE%3D
Attack Vector
Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity Issue Source File / Package
HIGH Improper_Restriction_of_Stored_XXE_Ref /subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApiMain.java: 214

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR

@thc202 thc202 changed the title CVE-2021-33813: Removed jdom dependency Remove JDOM dependency Dec 22, 2025
@thc202
Copy link
Member

thc202 commented Dec 22, 2025

Make sure the build checks pass.

## [Unreleased]
### Removed
- Removed jdom dependency
- Address XXE in JDOM SAXBuilder [CVE-2021-33813](https://github.com/advisories/GHSA-2363-cqg2-863c)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is irrelevant for usage done by the API client.

### Removed
- Removed jdom dependency
- Address XXE in JDOM SAXBuilder [CVE-2021-33813](https://github.com/advisories/GHSA-2363-cqg2-863c)
- Use w3c dom instead
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is irrelevant for the end user.


## [Unreleased]
### Removed
- Removed jdom dependency
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

JDOM

@aalsanie aalsanie closed this Dec 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants