[JENKINS-65161] remove commons-digester2 from core and upgrade plugins to commons-digester3

[olamy]

No description provided.

[olamy]

jenkinsci/jenkins#5320

[batmat]

Hi @mrmoritz01, thanks a lot for merging this PR :).
Would you be able to consider releasing this?

Thanks again!

[basil]

Does this not introduce a security vulnerability? I don't see the XXE mitigations in this PR that I see in the other similar PRs.

[jtnord]

Does this not introduce a security vulnerability? I don't see the XXE mitigations in this PR that I see in the other similar PRs.

The plugin already had them ->

cvs-plugin/src/main/java/hudson/scm/CVSChangeLogSet.java

Lines 120 to 134 in 6f8aa8e

	Digester digester = new Digester();
	digester.setXIncludeAware(false);
	if (!Boolean.getBoolean(CVSChangeLogParser.class.getName() + ".UNSAFE")) {
	try {
	digester.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
	digester.setFeature("http://xml.org/sax/features/external-general-entities", false);
	digester.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
	digester.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
	}
	catch (ParserConfigurationException ex) {
	throw new SAXException("Failed to securely configure CVS changelog parser", ex);
	}
	}

[basil]

Phew, sorry for the false alarm.

[batmat]

Better safe than sorry, thanks for cross-checking Basil!

[mrmoritz01]

@batmat This is released in cvs-plugin 2.19 now.