Exclude org.json pulled in by Closure Templates The gitiles SBOM scan (//:gitiles_sbom_scan, Trivy over the generated CycloneDX SBOM) flagged org.json:json 20230618 shipping in gitiles.war with CVE-2023-5072 (HIGH): a parser confusion that can exhaust memory. It is pulled in transitively by Closure Templates (com.google.template:soy). Gitiles does not use org.json in its own code, and Gerrit excludes it from the same soy version and ships without it. So omit it here the same way we dropped end-of-life log4j 1.x: exclude the transitive jar from soy and re-pin. The war no longer ships json-20230618.jar and the scan is clean. Change-Id: I2d8cc40b8c38fcf2e0f8392adf4e93d92ae2c404
Gitiles is a simple repository browser for Git repositories, built on JGit. Its guiding principle is simplicity: it has no formal access controls, no write access, no fancy Javascript, etc.
Gitiles automatically renders *.md Markdown files into HTML for simplified documentation. Refer to the Markdown documentation for details.
Gitiles is configurable in a git-style configuration file named gitiles.config. Refer to the configuration documentation for details.
Use gerrit's issue tracker to file bugs.
Please refer to the Developer Guide.