From 436e83de5eb56319aa5a292810f0c5e78aacbb47 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Wed, 14 Oct 2026 07:36:16 +0200 Subject: [PATCH] data: access-control batch 2 spot-checked; all 69 passing locations accepted (27 changes, reviewer mc) Co-Authored-By: Claude Fable 5.1 --- .../train/verification_access_control.json | 552 +++++++++++++----- 1 file changed, 414 insertions(+), 138 deletions(-) diff --git a/benchmarks/valid/train/verification_access_control.json b/benchmarks/valid/train/verification_access_control.json index 33c68df..a01e8b1 100644 --- a/benchmarks/valid/train/verification_access_control.json +++ b/benchmarks/valid/train/verification_access_control.json @@ -89,11 +89,15 @@ "confidence": 0.75, "entry_point": "/hazelcast/rest/maps/submit-job (SubmitJobServlet) via JettyService.createJettyServer", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "apache-seatunnel-aff20b2911a11f57", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -617,11 +621,15 @@ "confidence": 0.75, "entry_point": "UserControls 'userControls' extension rendering the private-discussion button on a user's profile page; source is the target user's blocksPd/cannotBeDirectMessaged attributes", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "friendsofflarum-byobu-7173b8a509cf3e27", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -629,11 +637,15 @@ "confidence": 0.75, "entry_point": "PrivateDiscussionsUserPage.actionItems rendered via content() on the user private discussions page route (m.route.param('username'))", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "friendsofflarum-byobu-f34c4fa78b9178db", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -653,11 +665,15 @@ "confidence": 0.85, "entry_point": "DefaultGraphConfigurationView#doSave form handler (configureDefaults URL) via StaplerRequest", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-analysis-core-plugin-e02e86e3c18ec1d6", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -665,11 +681,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint /descriptorByName/com.microsoft.jenkins.keyvault.SecretStringCredentials/doVerifyConfiguration (doVerifyConfiguration in DescriptorImpl), invoked via web request with servicePrincipalId and secretIdentifier query parameters", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-azure-credentials-plugin-0dab78b4ed2c29bb", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -677,11 +697,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler web endpoint doFillServicePrincipalIdItems on the Azure Credentials DescriptorImpl (form fill for servicePrincipalId), reachable by any user with Overall/Read permission", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-azure-credentials-plugin-144d42edd4fea476", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -701,11 +725,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doVerifyConfiguration on AzureCredentials.DescriptorImpl, invoked via form validation request with query parameters (subscriptionId, clientId, clientSecret, etc.)", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-azure-credentials-plugin-81c51344b9d31af8", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -713,11 +741,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler web method doFillCertificateIdItems on AzureCredentials.DescriptorImpl, invoked via the credentials configuration form (e.g. /descriptorByName/com.microsoft.azure.util.AzureCredentials/fillCertificateIdItems) with the certificateId query parameter", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-azure-credentials-plugin-a83f939fb055e6a0", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -725,11 +757,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint DescriptorImpl.doVerifyConfiguration (form validation endpoint) invoked via web request with @QueryParameter servicePrincipalId/secretIdentifier/password", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-azure-credentials-plugin-af7645f7ae48e24c", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -737,11 +773,15 @@ "confidence": 0.75, "entry_point": "DescriptorImpl.doVerifyConfiguration (@POST, @QueryParameter subscriptionId/clientId/azureEnvironmentName)", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-azure-credentials-plugin-bd1228731e6d22aa", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -749,11 +789,15 @@ "confidence": 0.85, "entry_point": "Jenkins DescriptorImpl.doVerifyConfiguration (AzureImdsCredentials) exposed via Stapler HTTP endpoint /descriptorByName/.../doVerifyConfiguration with @QueryParameter subscriptionId, clientId, azureEnvironmentName", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-azure-credentials-plugin-d3c1129ce0199756", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -773,11 +817,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialIDOverrideItems on AzureKeyVaultBuildWrapper.DescriptorImpl (form fill for credentialIDOverride field), reachable by any user with Overall/Read permission", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-azure-keyvault-plugin-a9975f6d8b4f1568", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -785,11 +833,15 @@ "confidence": 0.75, "entry_point": "DescriptorImpl.doFillCredentialIDItems (Jenkins Stapler HTTP endpoint /job/.../descriptorByName/.../fillCredentialIDItems)", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-azure-keyvault-plugin-abd182ce20617255", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -797,11 +849,15 @@ "confidence": 0.85, "entry_point": "GithubServerContainer.create(@JsonBody JSONObject request) invoked via Blue Ocean HTTP endpoint for creating GitHub server; attacker-controlled source is the 'apiUrl' field in the JSON request body, which is passed to HttpRequest.get(url).connect()", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-blueocean-plugin-5aa4f2eb0a53ebfe", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -809,11 +865,15 @@ "confidence": 0.75, "entry_point": "Blue Ocean REST endpoint POST /blueocean/rest/.../servers (ScmServerEndpointContainer.create) accepting JSONObject request with attacker-controlled API_URL", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-blueocean-plugin-e4ad2dadd845ec00", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -821,11 +881,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job//descriptorByName/.../fillConnectionIdItems) invoked via config.jelly connectionId field; attacker-controlled source is the HTTP request with Overall/Read permission", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-compuware-scm-downloader-plugin-29636a1534a39217", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -833,11 +897,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job//descriptorByName/.../fillConnectionIdItems) invoked via config.jelly connectionId field; attacker-controlled source is the HTTP request with Overall/Read permission", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-compuware-scm-downloader-plugin-316557e9fdf67223", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -845,11 +913,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialsIdItems (e.g. /job//descriptorByName/.../fillCredentialsIdItems) invoked with Overall/Read permission; attacker-controlled source is the credentialsId query parameter and the project ancestor context", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-compuware-scm-downloader-plugin-4b64810cb01a07f5", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -857,11 +929,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job//descriptorByName/.../fillConnectionIdItems) invoked via config.jelly connectionId field; attacker-controlled source is the HTTP request with Overall/Read permission", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-compuware-scm-downloader-plugin-936a096a4a941ee5", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -869,11 +945,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job//descriptorByName/.../fillConnectionIdItems) invoked via @QueryParameter connectionId", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-compuware-scm-downloader-plugin-c416a32628e63296", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -881,11 +961,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialsIdItems (descriptor form fill for credentialsId), reachable via Overall/Read authenticated user; source is the credentialsId query parameter and the credentials store enumerated via CredentialsProvider.lookupCredentials", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-compuware-topaz-for-total-test-plugin-0fcc9e440100be20", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -893,11 +977,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job//descriptorByName/.../fillConnectionIdItems) invoked with Overall/Read permission; @QueryParameter connectionId is attacker-controlled", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-compuware-topaz-for-total-test-plugin-31007615cf224711", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -905,11 +993,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillConnectionIdItems (e.g. /job//descriptorByName/.../fillConnectionIdItems) invoked via @QueryParameter connectionId", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-compuware-topaz-for-total-test-plugin-3b2dc3167c986714", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -917,11 +1009,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialsIdItems on TotalTestCTBuilder (e.g. /job//descriptorByName/.../fillCredentialsIdItems), invoked via @QueryParameter credentialsId with Overall/Read permission", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-compuware-topaz-for-total-test-plugin-8659f27b971d364f", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -929,11 +1025,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillServerUrlItems / doFillServerCredentialsIdItems (form fill methods invoked via Jenkins UI/HTTP request with Overall/Read permission)", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-compuware-topaz-for-total-test-plugin-b0ca3df515237e75", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -941,11 +1041,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillServerCredentialsIdItems (descriptor form fill method) reachable via the build step configuration UI; attacker-controlled source is the @QueryParameter serverCredentialsId and the Overall/Read authenticated user", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-compuware-topaz-for-total-test-plugin-e724ca5f96b58ee5", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -953,11 +1057,15 @@ "confidence": 0.75, "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialIDItems (form fill for credential ID field), invoked via web request with uri query parameter", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-conjur-credentials-plugin-11205c0022207637", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -965,11 +1073,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialIDItems on ConjurSecretUsernameSSHKeyCredentialsImpl.DescriptorImpl, invoked via the credentials form fill (e.g. credentialID field) with @QueryParameter uri", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-conjur-credentials-plugin-25bfc860016819fb", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -977,11 +1089,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillCredentialIDItems on ConjurSecretUsernameCredentialsImpl.DescriptorImpl, invoked via the credentials form fill (e.g. /descriptorByName/.../fillCredentialIDItems) with attacker-controlled @QueryParameter uri", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-conjur-credentials-plugin-f42fa606284883ea", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1001,11 +1117,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint /descriptor/.../fillCredentialsIdItems (doFillCredentialsIdItems) invoked via form binding with @QueryParameter value", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-crx-content-package-deployer-plugin-79286d969348bd3c", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1013,11 +1133,15 @@ "confidence": 0.85, "entry_point": "Stapler form validation endpoint doValidate on AbstractRemoteDatabaseDescriptor (e.g. /descriptorByName/.../validate) invoked via HTTP with @QueryParameter hostname, database, username, password, properties", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-database-plugin-6a8e141d0c9eaab2", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1025,11 +1149,15 @@ "confidence": 0.85, "entry_point": "Jenkins form validation endpoint /descriptorByName/org.jenkinsci.plugins.database.GenericDatabase/doValidate (and doCheckDriver), invoked via HTTP with attacker-controlled driver, url, username, password query parameters", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-database-plugin-d2e038dce743f4f4", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1037,11 +1165,15 @@ "confidence": 0.85, "entry_point": "Jenkins form validation endpoint doValidate (Descriptor.doValidate) invoked via HTTP POST with query parameters driver, url, username, password", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-database-plugin-fdb5a7fd01260ec1", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1049,11 +1181,15 @@ "confidence": 0.6, "entry_point": "Stapler HTTP endpoint doCheckDirectoryPath (FormValidation) on FixedDirectoryDeploySource.DescriptorImpl, invoked via @QueryParameter fromWorkspace/targetDescriptorId/value", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-deployer-framework-plugin-2929f3e176f304ad", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1109,11 +1245,15 @@ "confidence": 0.85, "entry_point": "Stapler HTTP endpoint doDeployText (DeployNowRunAction) reachable via URL /job///deploy-text or similar Stapler route; attacker-controlled source is the HTTP request handled by StaplerRequest req, with only Item/Read permission required pre-fix", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-deployer-framework-plugin-dd5ef66a767e04d5", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1121,11 +1261,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler form validation endpoint doTestConnection on EC2Cloud.DescriptorImpl, invoked via HTTP form validation request with attacker-controlled ec2endpoint, credentialsId, roleArn, roleSessionName, region parameters", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-ec2-plugin-6058527110940076", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1133,11 +1277,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler form validation endpoint /descriptorByName/hudson.plugins.ec2.EC2Cloud/doGenerateKey (and doTestConnection), invoked via HTTP with attacker-controlled ec2EndpointUrl, credentialsId, region parameters", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-ec2-plugin-92278d8bf0b7f60a", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1145,11 +1293,15 @@ "confidence": 0.9, "entry_point": "HTTP POST to the ElectricFlowEFRunAPIAction endpoint (getUrlName() URL_NAME) invoking doBuild(StaplerRequest, StaplerResponse); attacker-controlled JSON body read via req.getReader() supplies flowRuntimeId/projectName/releaseName/buildParams and triggers Jenkins.get().getQueue().schedule(project, ...)", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-electricflow-plugin-b319df3a71ebd890", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1157,11 +1309,15 @@ "confidence": 0.95, "entry_point": "/git/notifyCommit webhook endpoint handled by GitStatus.doNotifyCommit(HttpServletRequest, url, branches, sha1)", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-git-plugin-751c41fb6795520f", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1181,11 +1337,15 @@ "confidence": 0.9, "entry_point": "GlobalBuildStatsApi.doPython (and doJson/doXml) REST API endpoint via Stapler, source: buildStatConfigId request parameter", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-global-build-stats-plugin-b2560994597ff44f", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1193,11 +1353,15 @@ "confidence": 0.85, "entry_point": "GlobalBuildStatsApi.doJson (REST API endpoint /api/json via getApi()), source: buildStatConfigId request parameter", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-global-build-stats-plugin-ee8d1b0fdf63b4ee", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1205,11 +1369,15 @@ "confidence": 0.85, "entry_point": "Jenkins HTTP endpoint invoking DescriptorImpl.doCheckScript with @QueryParameter String command (Groovy command script source descriptor)", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-groovy-plugin-74141466f39e1a12", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1217,11 +1385,15 @@ "confidence": 0.9, "entry_point": "Jenkins Stapler HTTP endpoint DescriptorImpl.doTestConnection (Vault Username-Password Credential descriptor), invoked via form validation request with attacker-controlled query parameters path, usernameKey, passwordKey, prefixPath, namespace, engineVersion", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-hashicorp-vault-plugin-4b8dac7099e598b2", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1229,11 +1401,15 @@ "confidence": 0.9, "entry_point": "Jenkins Stapler HTTP endpoint doTestConnection on VaultSSHUserPrivateKeyImpl.DescriptorImpl (e.g. /descriptorByName/.../testConnection), with attacker-controlled query parameters path, usernameKey, privateKeyKey, passphraseKey, prefixPath, namespace, engineVersion", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-hashicorp-vault-plugin-69b136827df9a5c0", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1241,11 +1417,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doTestConnection on VaultStringCredentialImpl.DescriptorImpl, invoked via the credential configuration form with attacker-controlled query parameters path, vaultKey, prefixPath, namespace, engineVersion", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-hashicorp-vault-plugin-7782cfb6ae3f0339", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1253,11 +1433,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint DescriptorImpl.doTestConnection (e.g. /descriptorByName/.../testConnection) with @QueryParameter path/keyStoreKey/passwordKey/prefixPath/namespace/engineVersion", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-hashicorp-vault-plugin-9f7965aeec3cc869", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1265,11 +1449,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doTestConnection on VaultFileCredentialImpl.DescriptorImpl (e.g. /descriptorByName/com.datapipe.jenkins.vault.credentials.common.VaultFileCredentialImpl/testConnection), with attacker-controlled query parameters path, useKey, vaultKey, prefixPath, namespace, engineVersion", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-hashicorp-vault-plugin-c76a541ee22b2ef9", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1277,11 +1465,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint DescriptorImpl.doTestConnection (e.g. /descriptorByName/.../testConnection) with @QueryParameter path/prefixPath/namespace/engineVersion", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-hashicorp-vault-plugin-e7d568b004427b1d", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1289,11 +1481,15 @@ "confidence": 0.9, "entry_point": "Jenkins Stapler HTTP endpoint doValidateGlobal on JiraTestDataPublisher (global.jelly 'Validate Settings' button), parameters jiraUrl/username/password", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-jiratestresultreporter-plugin-28213733c6b799eb", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1301,11 +1497,15 @@ "confidence": 0.85, "entry_point": "Jenkins form validation endpoint doValidateClient (GlobalPluginConfiguration), invoked via Jenkins form validation HTTP request with attacker-controlled 'server' and 'namespace' query parameters", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-jx-resources-plugin-e1eb49dbe32bfc7a", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1325,11 +1525,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillApplicationIdItems (e.g. /job//descriptorByName/com.mabl.integration.jenkins.MablStepBuilder/fillApplicationIdItems) with attacker-controlled query parameters restApiKeyId, apiBaseUrl, appBaseUrl", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-mabl-integration-plugin-010c7741299085f7", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1337,11 +1541,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillRestApiKeyIdItems (e.g. /job//descriptorByName/com.mabl.integration.jenkins.MablStepBuilder/fillRestApiKeyIdItems) invoked with attacker-controlled restApiKeyId query parameter", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-mabl-integration-plugin-33601449707f721c", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1373,11 +1581,15 @@ "confidence": 0.85, "entry_point": "doFillApplicationIdItems HTTP endpoint (Jenkins Stapler @QueryParameter restApiKeyId, disableSslVerification, apiBaseUrl, appBaseUrl) reachable by users with Overall/Read permission", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-mabl-integration-plugin-5f366608a3d422b4", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1385,11 +1597,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doCheckRestApiKeyIds (and doFillApplicationIdItems) on MablStepBuilder, invoked via the mabl build step configuration form; attacker-controlled source is the @QueryParameter value/restApiKeyId supplied in the HTTP request by a user with Overall/Read permission", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-mabl-integration-plugin-60b82fbf81b044f5", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1397,11 +1613,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doFillEnvironmentIdItems (MablStepBuilder), reachable via GET/POST to the descriptor fill URL with attacker-controlled query parameters restApiKeyId, disableSslVerification, apiBaseUrl, appBaseUrl", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-mabl-integration-plugin-8cc76fc9d5aa0984", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1421,11 +1641,15 @@ "confidence": 0.85, "entry_point": "MablStepDescriptor.doValidateForm HTTP endpoint (Stapler @QueryParameter restApiKeyId/environmentId/applicationId/disableSslVerification/apiBaseUrl/appBaseUrl)", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-mabl-integration-plugin-b2206be4bf8e37fb", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1433,11 +1657,15 @@ "confidence": 0.85, "entry_point": "doFillEnvironmentIdItems (Jenkins Stapler HTTP endpoint, @QueryParameter restApiKeyId/apiBaseUrl/appBaseUrl/disableSslVerification)", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-mabl-integration-plugin-c9df9fe333e3ed08", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1481,11 +1709,15 @@ "confidence": 0.75, "entry_point": "NomadCloud.DescriptorImpl#doCheckName form validation endpoint (Jenkins Stapler HTTP route /descriptorByName/org.jenkinsci.plugins.nomad.NomadCloud/checkName), source: @QueryParameter String name", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-nomad-plugin-81a6fad8feb01b11", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1577,11 +1809,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doCheckElasticsearchCredentialsId (form validation for ElasticLogsBackendWithJenkinsVisualization), invoked via POST with elasticsearchCredentialsId query parameter by a user with Overall/Read permission", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-opentelemetry-plugin-62ce6dc3488e0d80", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1589,11 +1825,15 @@ "confidence": 0.75, "entry_point": "Jenkins Stapler HTTP endpoint doFillElasticsearchCredentialsIdItems on the ElasticLogsBackendWithJenkinsVisualization.DescriptorImpl (invoked via the plugin configuration form, e.g. /descriptorByName/.../fillElasticsearchCredentialsIdItems), with attacker-controlled source being the elasticsearchCredentialsId query parameter", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-opentelemetry-plugin-c258c6ed37f2c061", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1601,11 +1841,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint DescriptorImpl.doValidate (and doCheckElasticsearchUrl/doCheckElasticsearchCredentialsId) invoked via form validation request with attacker-controlled elasticsearchUrl and elasticsearchCredentialsId query parameters", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-opentelemetry-plugin-e7dc96d707803ae7", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1613,11 +1857,15 @@ "confidence": 0.85, "entry_point": "Jenkins Stapler HTTP endpoint doValidate on ElasticLogsBackendWithJenkinsVisualization (POST form validation), attacker-controlled elasticsearchUrl and elasticsearchCredentialsId query parameters", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-opentelemetry-plugin-f0ff00bf7375eb29", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1625,11 +1873,15 @@ "confidence": 0.9, "entry_point": "Jenkins Stapler form validation endpoint doTestConnection (e.g. /descriptorByName/jenkins.plugins.rocketchatnotifier.RocketChatNotifier/doTestConnection) with attacker-controlled query parameters rocketServerUrl, username, password, webhookToken, webhookTokenCredentialId", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-rocketchatnotifier-plugin-16d28ce862d5a528", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1637,11 +1889,15 @@ "confidence": 0.85, "entry_point": "Jenkins CLI command 'support' (SupportCommand.run) invoked via CLI channel; attacker-controlled source is the CLI invocation by a user holding Support/DownloadBundle permission", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-support-core-plugin-3de9ccb2591c7490", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1649,11 +1905,15 @@ "confidence": 0.85, "entry_point": "SupportAction (RootAction, urlName \"support\") via StaplerProxy getTarget(); HTTP request to /support/... reaches getTarget() which checks CREATE_BUNDLE (Support/DownloadBundle) instead of Jenkins.ADMINISTER, allowing users with only Support/DownloadBundle permission to access support bundle endpoints", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "jenkinsci-support-core-plugin-934a17bf668da541", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1685,11 +1945,15 @@ "confidence": 0.75, "entry_point": "GET /save-invoice/{customer}/{template} (route name invoice_create) in InvoiceController::createInvoiceAction", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "kimai-kimai-166480170479d403", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1697,11 +1961,15 @@ "confidence": 0.85, "entry_point": "GET /preview/{customer}/{template} route (invoice_preview) in InvoiceController::previewAction; attacker-controlled source is the {customer} route parameter (Customer entity) and {template} parameter, with only is_granted('view_invoice') enforced pre-fix", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "kimai-kimai-5e04ee92bdb735ea", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1757,11 +2025,15 @@ "confidence": 0.85, "entry_point": "WebSocket TerminalWebsocketServer.open (terminal_server.py) via /terminals/websocket route; attacker-controlled source: websocket query arguments api_key, token, cwd, term_name", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "mage-ai-mage-ai-c9810ee637c308c0", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true }, { @@ -1769,11 +2041,15 @@ "confidence": 0.6, "entry_point": "Terminal component (mage_ai/frontend/components/Terminal/index.tsx) rendered in the Mage web UI; keyboard input via registerOnKeyDown and sendMessage WebSocket channel", "fix_addresses_it": true, - "human_spot_check": null, + "human_spot_check": { + "date": "2026-10-13", + "decision": "accept", + "reviewer": "mc" + }, "id": "mage-ai-mage-ai-d1ee6d54adc38f57", "model": "deepseek-flash", "reachable_in_repo": true, - "verdict": "pending_human", + "verdict": "accepted", "vulnerable_pre_fix": true } ]