feat(java): detect HttpResponses.html served with non-literal content (CWE-79)

java/jenkins/xss/httpresponses-html-tainted.yaml

@@ -0,0 +1,34 @@
+rules:
+  - id: codevigilant.java.jenkins.xss.httpresponses-html-tainted
+    patterns:
+      - pattern: HttpResponses.html($CONTENT)
+      - metavariable-pattern:
+          metavariable: $CONTENT
+          patterns:
+            - pattern-not: |
+                "..."
+    message: |
+      Detected org.kohsuke.stapler.HttpResponses.html() called with a
+      non-literal argument. The method serves the value back to the browser
+      as text/html in the Jenkins origin. When the value originates from a
+      remote server response (report/HTML content, API error messages),
+      job configuration or build data, markup embedded in it is interpreted
+      as HTML/script in the Jenkins origin with the viewer's session
+      (stored/reflected XSS, CWE-79). Sanitize the content (e.g. OWASP Java
+      HTML Sanitizer) or serve it from an opaque origin (sandboxed iframe /
+      srcdoc) and add Content-Security-Policy + X-Content-Type-Options
+      headers.
+    metadata:
+      category: security
+      cwe: "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
+      owasp: "A03:2021 - Injection"
+      technology: jenkins
+      confidence: MEDIUM
+      references:
+        - https://www.jenkins.io/doc/developer/security/#cross-site-scripting-xss
+        - https://owasp.org/www-community/attacks/xss/
+      source: independent security review
+      license: MIT
+    languages: [java]
+    mode: search
+    severity: HIGH