{"record":{"id":"d3cc91e8f89391af","repo":"jenkinsci/jenkins","slug":"invalid-iconsize","errorCode":null,"errorMessage":"invalid iconSize","messagePattern":"invalid iconSize","errorType":"validation","errorClass":"SecurityException","httpStatus":null,"severity":"warning","filePath":"core/src/main/java/hudson/Functions.java","lineNumber":672,"sourceCode":"        Cookie c = getCookie(req, name);\n        if (c == null || c.getValue() == null) return defaultValue;\n        return c.getValue();\n    }\n\n    /**\n     * @deprecated use {@link #getCookie(HttpServletRequest, String, String)}\n     */\n    @Deprecated\n    public static String getCookie(javax.servlet.http.HttpServletRequest req, String name, String defaultValue) {\n        return getCookie(HttpServletRequestWrapper.toJakartaHttpServletRequest(req), name, defaultValue);\n    }\n\n    private static final Pattern ICON_SIZE = Pattern.compile(\"\\\\d+x\\\\d+\");\n\n    @Restricted(NoExternalUse.class)\n    public static String validateIconSize(String iconSize) throws SecurityException {\n        if (!ICON_SIZE.matcher(iconSize).matches()) {\n            throw new SecurityException(\"invalid iconSize\");\n        }\n        return iconSize;\n    }\n\n    /**\n     * No longer used, to be removed after enough plugins have adopted a version of the test harness with\n     * <a href=\"https://github.com/jenkinsci/jenkins-test-harness/pull/874\">jenkins-test-harness/pull/874</a> in it.\n     *\n     * @deprecated removed without replacement\n     */\n    @SuppressFBWarnings(value = \"MS_SHOULD_BE_FINAL\", justification = \"for script console\")\n    @Deprecated(forRemoval = true, since = \"TODO\")\n    public static boolean DEBUG_YUI;\n\n    /**\n     * Creates a sub map by using the given range (both ends inclusive).\n     */\n    public static <V> SortedMap<Integer, V> filter(SortedMap<Integer, V> map, String from, String to) {","sourceCodeStart":654,"sourceCodeEnd":690,"githubUrl":"https://github.com/jenkinsci/jenkins/blob/2e228ff40b14dbc8b14ffbc6edf0e4383cf744fc/core/src/main/java/hudson/Functions.java#L654-L690","documentation":"validateIconSize throws SecurityException when the provided iconSize string does not match the regex \\d+x\\d+ (e.g., '16x16', '32x32'). This guards against malformed input used to construct icon dimension parameters in Jenkins UI rendering. It is a SecurityException (not IllegalArgumentException) because iconSize typically arrives from HTTP request parameters, making it part of the request validation surface.","triggerScenarios":"An HTTP request parameter or configuration value for icon size that does not conform to the NxM pattern, e.g., '16', '16x', 'x16', '16x16x16', or containing non-numeric characters.","commonSituations":"A plugin or REST API consumer passing an icon size from user input without sanitization, a stale bookmark/URL with a truncated or corrupted iconSize query parameter, or a configuration file with a malformed value.","solutions":["Sanitize the iconSize input to match \\d+x\\d+ before passing it to validateIconSize.","Provide a sensible default (e.g., '24x24') when the input is blank or malformed.","Catch SecurityException at the request boundary and return a 400 error with a helpful message."],"exampleFix":"// before\nString iconSize = req.getParameter(\"iconSize\");\nFunctions.validateIconSize(iconSize);\n\n// after — normalize before validating\nString iconSize = req.getParameter(\"iconSize\");\nif (iconSize == null || !iconSize.matches(\"\\\\d+x\\\\d+\")) {\n    iconSize = \"24x24\";\n}","handlingStrategy":"validation","validationCode":"private static final Pattern VALID_ICON_SIZE = Pattern.compile(\"\\\\d+x\\\\d+\");\npublic static String sanitizeIconSize(String input) {\n    if (input != null && VALID_ICON_SIZE.matcher(input).matches()) {\n        return input;\n    }\n    return \"24x24\";\n}","typeGuard":"public static boolean isValidIconSize(String s) {\n    return s != null && s.matches(\"\\\\d+x\\\\d+\");\n}","tryCatchPattern":"try {\n    Functions.validateIconSize(iconSize);\n} catch (SecurityException e) {\n    iconSize = \"24x24\"; // fall back to default\n}","preventionTips":["Always sanitize iconSize from request parameters before use.","Provide a default icon size when input is missing or malformed."],"tags":["validation","ui","security","request-parameter"],"backgroundTag":null,"analyzedSha":"2e228ff40b14dbc8b14ffbc6edf0e4383cf744fc","analyzedAt":"2026-08-14T07:07:15.274Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}