Use jsStringEscape where necessary.
Exclude NekoHTML and its concomitant obsolete Xerces.
[FIXED SECURITY-46]
[SECURITY-55]

This patch makes standard post-build action refuse to let you configure a downstream project you cannot currently build.
The one from parameterized-trigger will show an error in the configure screen but still lets you save the configuration; needs an analogous patch to that plugin.
Does not yet protect against POSTing config.xml with the trigger.
[SECURITY-13]
[SECURITY-16]

Require POST for various operations.
[SECURITY-60] Upgrade Spring.
[SECURITY-47]

- My second patch, with whitelisted XPath values and forbidden JSONP.
- Disabling JSONP altogether for REST API (unless explicitly allowed).
- Forbid primitive XPath result sets by default.
- Refuse to serve _crumb=123456 as this could (very hypothetically) be exploited.
Merge remote-tracking branches 'origin/SECURITY-13', 'origin/SECURITY-16', 'origin/SECURITY-46', 'origin/SECURITY-47', 'origin/SECURITY-55', 'origin/SECURITY-59', 'origin/SECURITY-60' and 'origin/SECURITY-61' into stable
Oops, I forgot to actually use it
(cherry picked from commit 9eadc32227915f52e0a1f54c50bf4874488cba1a)
Strengthening regexp a bit.(cherry picked from commit 7b15466d92410374dcaa8b812b33b0a813e1c559)
[maven-release-plugin] prepare release jenkins-1.480.3
[maven-release-plugin] prepare for next development iteration
updated changelog as a part of the release