[JENKINS-68404] Add ScriptUsageListener to track Groovy scripts #72
Conversation
src/main/resources/hudson/plugins/audit_trail/AuditTrailPlugin/config.jelly
Show resolved
Hide resolved
…/config.jelly Co-authored-by: Tim Jacomb <21194782+timja@users.noreply.github.com>
|
With jenkinsci/jenkins#7056 being merged, I will continue on this PR soon :) |
|
Thanks! Most of the conflicts you'll see are due to the introduction of spotless on the codeline. |
|
Still active? |
Since I would love to see this feature, yes. However, there are many other more pressing things right now, but I definitely want to do this. However, if someone stumbles upon this before I find time, feel free! |
…ener # Conflicts: # pom.xml # src/main/java/hudson/plugins/audit_trail/AuditTrailPlugin.java # src/test/java/hudson/plugins/audit_trail/ConfigurationAsCodeTest.java # src/test/java/hudson/plugins/audit_trail/SimpleAuditTrailPluginConfiguratorHelper.java
|
@meiswjn I took the liberty of refreshing this PR and adapting to the new ScriptListener API. I wrote a simple mapper to transform the |
|
That's great, thanks @PierreBtz! Much appreciated. |
|
Well the problem is to find reviewers since I'm the only maintainer of the plugin. |
| builder.append(script); | ||
| String log = builder.toString(); | ||
| if (LOGGER.isLoggable(Level.FINE)) { | ||
| LOGGER.log(Level.FINE, "Detected groovy script usage, details: {0}", new Object[] {log}); |
There was a problem hiding this comment.
I would be wary about logging scripts, this is user controlled input data, they may be able to print data that messes with viewing of other logs?
FINE does mitigate the concern a bit though as it is only there for troubleshooting
There was a problem hiding this comment.
Fair concern especially when you still have log4shell in mind :)
That beeing said, I'd say that the FINE level mitigates the issue enough.
|
Thanks @PierreBtz! |
4 participants
This PR relates to jenkinsci/jenkins#6539, jenkinsci/script-security-plugin#416 and https://issues.jenkins.io/browse/JENKINS-68404. It serves the purpose to track potentially dangerous usages of groovy scripts.