Discussion: How to reproduce vulnerability described in https://github.com/jhy/jsoup/security/advisories/GHSA-m72m-mhq2-9p6c

[jsmrcka]

In an attempt to verify the vulnerability for our project, we are running tests against unpatched jsoup 1.14.1 (and also 1.13.1) using reproducer testcases from:

• Fuzz: 37155: jsoup:HtmlFuzzer: Uncaught exception in java.base/jdk.internal.util.Preconditions.outOfBounds #1611 (https://oss-fuzz.com/download?testcase_id=5920704691306496)
• 37142: jsoup:XmlFuzzer: Uncaught exception in org.jsoup.parser.CharacterReader.unconsume #1612 (https://oss-fuzz.com/download?testcase_id=6533282119417856)

Both tests pass.

What is the proper way to reproduce?

[jhy]

Those issues may not have been in a specific release.

[jsmrcka]

Those issues may not have been in a specific release.

@jhy What does that mean? Do you know a way to reproduce the issues? It would really help us if we were able to write a test which would fail/pass for unfixed/fixed release.

[jhy]

There are test cases that cover each of the fixes. But to my mind, the simplest way to check if it's a vulnerable version is to look at the version number.