[org.jenkins-ci.plugins:junit] Jenkins JUnit Plugin subject to Cross-site Scripting via URL conversion

JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links.

This is done in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

JUnit Plugin 1160.vf1f01a_a_ea_b_7f no longer converts URLs to clickable links.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-45380
• https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2888
• https://github.com/advisories/GHSA-298r-5c48-7q2r