2424
2525package org .jenkinsci .plugins .workflow .libs ;
2626
27- import com .cloudbees .hudson .plugins .folder .Folder ;
2827import edu .umd .cs .findbugs .annotations .NonNull ;
2928import hudson .AbortException ;
3029import hudson .FilePath ;
31- import hudson .Functions ;
3230import hudson .model .Item ;
3331import hudson .model .Result ;
3432import hudson .model .TaskListener ;
3735import hudson .slaves .WorkspaceList ;
3836import java .io .File ;
3937import java .io .IOException ;
40- import java .nio .charset .StandardCharsets ;
41- import java .nio .file .Files ;
42- import java .nio .file .Path ;
4338import java .util .Collections ;
4439import java .util .Iterator ;
4540import java .util .List ;
5348import jenkins .scm .api .SCMSource ;
5449import jenkins .scm .api .SCMSourceCriteria ;
5550import jenkins .scm .api .SCMSourceDescriptor ;
56- import jenkins .scm .impl .subversion .SubversionSCMSource ;
57- import jenkins .scm .impl .subversion .SubversionSampleRepoRule ;
58- import org .apache .commons .io .FileUtils ;
5951import org .jenkinsci .plugins .workflow .cps .CpsFlowDefinition ;
6052import org .jenkinsci .plugins .workflow .job .WorkflowJob ;
6153import org .jenkinsci .plugins .workflow .job .WorkflowRun ;
8577import static org .hamcrest .Matchers .arrayWithSize ;
8678import static org .hamcrest .Matchers .equalTo ;
8779import static org .hamcrest .Matchers .matchesPattern ;
88- import static org .hamcrest .Matchers .nullValue ;
8980import static org .jenkinsci .plugins .workflow .libs .SCMBasedRetriever .PROHIBITED_DOUBLE_DOT ;
90- import static org .junit .Assume .assumeFalse ;
9181import org .jvnet .hudson .test .FlagRule ;
9282import org .jvnet .hudson .test .LoggerRule ;
9383
@@ -96,7 +86,6 @@ public class SCMSourceRetrieverTest {
9686 @ ClassRule public static BuildWatcher buildWatcher = new BuildWatcher ();
9787 @ Rule public JenkinsRule r = new JenkinsRule ();
9888 @ Rule public GitSampleRepoRule sampleRepo = new GitSampleRepoRule ();
99- @ Rule public SubversionSampleRepoRule sampleRepoSvn = new SubversionSampleRepoRule ();
10089 @ Rule public FlagRule <Boolean > includeSrcTest = new FlagRule <>(() -> SCMBasedRetriever .INCLUDE_SRC_TEST_IN_LIBRARIES , v -> SCMBasedRetriever .INCLUDE_SRC_TEST_IN_LIBRARIES = v );
10190 @ Rule public LoggerRule logging = new LoggerRule ().record (SCMBasedRetriever .class , Level .FINE );
10291
@@ -487,87 +476,4 @@ public static class BasicSCMSource extends SCMSource {
487476 r .assertLogNotContains ("Excluding src/test/ from checkout" , b );
488477 }
489478
490- @ Issue ("SECURITY-2441" )
491- @ Test public void libraryNamesAreNotUsedAsCheckoutDirectories () throws Exception {
492- sampleRepo .init ();
493- sampleRepo .write ("vars/globalLibVar.groovy" , "def call() { echo('global library') }" );
494- sampleRepo .git ("add" , "vars" );
495- sampleRepo .git ("commit" , "--message=init" );
496- LibraryConfiguration globalLib = new LibraryConfiguration ("library" ,
497- new SCMSourceRetriever (new GitSCMSource (null , sampleRepo .toString (), "" , "*" , "" , true )));
498- globalLib .setDefaultVersion ("master" );
499- globalLib .setImplicit (true );
500- GlobalLibraries .get ().setLibraries (Collections .singletonList (globalLib ));
501- // Create a folder library with the same name as the global library so it takes precedence.
502- sampleRepoSvn .init ();
503- sampleRepoSvn .write ("vars/folderLibVar.groovy" , "def call() { jenkins.model.Jenkins.get().setSystemMessage('folder library') }" );
504- // Copy .git folder from the Git repo for the global library into the SVN repo for the folder library as data.
505- FileUtils .copyDirectory (new File (sampleRepo .getRoot (), ".git" ), new File (sampleRepoSvn .wc (), ".git" ));
506- sampleRepoSvn .svnkit ("add" , sampleRepoSvn .wc () + "/vars" );
507- sampleRepoSvn .svnkit ("add" , sampleRepoSvn .wc () + "/.git" );
508- sampleRepoSvn .svnkit ("commit" , "--message=init" , sampleRepoSvn .wc ());
509- LibraryConfiguration folderLib = new LibraryConfiguration ("library" ,
510- new SCMSourceRetriever (new SubversionSCMSource (null , sampleRepoSvn .prjUrl ())));
511- folderLib .setDefaultVersion ("trunk" );
512- folderLib .setImplicit (true );
513- Folder f = r .jenkins .createProject (Folder .class , "folder1" );
514- f .getProperties ().add (new FolderLibraries (Collections .singletonList (folderLib )));
515- // Create a job that uses the folder library, which will take precedence over the global library, since they have the same name.
516- WorkflowJob p = f .createProject (WorkflowJob .class , "p" );
517- p .setDefinition (new CpsFlowDefinition ("folderLibVar()" , true ));
518- // First build fails as expected since it is not trusted. The folder library is checked out.
519- WorkflowRun b1 = r .buildAndAssertStatus (Result .FAILURE , p );
520- r .assertLogContains ("Only using first definition of library library" , b1 );
521- r .assertLogContains ("Scripts not permitted to use staticMethod jenkins.model.Jenkins get" , b1 );
522- // Attacker deletes the folder library, then reruns the build.
523- // The existing checkout of the SVN repo should not be reused as the Git repo for the global library.
524- f .getProperties ().clear ();
525- WorkflowRun b2 = r .buildAndAssertStatus (Result .FAILURE , p );
526- r .assertLogContains ("No such DSL method 'folderLibVar'" , b2 );
527- assertThat (r .jenkins .getSystemMessage (), nullValue ());
528- }
529-
530- @ Issue ("SECURITY-2463" )
531- @ Test public void checkoutDirectoriesAreNotReusedByDifferentScms () throws Exception {
532- assumeFalse (Functions .isWindows ()); // Checkout hook is not cross-platform.
533- sampleRepo .init ();
534- sampleRepo .write ("vars/foo.groovy" , "def call() { echo('using global lib') }" );
535- sampleRepo .git ("add" , "vars" );
536- sampleRepo .git ("commit" , "--message=init" );
537- LibraryConfiguration globalLib = new LibraryConfiguration ("library" ,
538- new SCMSourceRetriever (new GitSCMSource (null , sampleRepo .toString (), "" , "*" , "" , true )));
539- globalLib .setDefaultVersion ("master" );
540- globalLib .setImplicit (true );
541- GlobalLibraries .get ().setLibraries (Collections .singletonList (globalLib ));
542- // Create a folder library with the same name as the global library so it takes precedence.
543- sampleRepoSvn .init ();
544- sampleRepoSvn .write ("vars/foo.groovy" , "def call() { echo('using folder lib') }" );
545- // Copy .git folder from the Git repo for the global library into the SVN repo for the folder library as data.
546- File gitDirInSvnRepo = new File (sampleRepoSvn .wc (), ".git" );
547- FileUtils .copyDirectory (new File (sampleRepo .getRoot (), ".git" ), gitDirInSvnRepo );
548- String jenkinsRootDir = r .jenkins .getRootDir ().toString ();
549- // Add a Git post-checkout hook to the .git folder in the SVN repo.
550- Path postCheckoutHook = gitDirInSvnRepo .toPath ().resolve ("hooks/post-checkout" );
551- // Always create hooks directory for compatibility with https://github.com/jenkinsci/git-plugin/pull/1207.
552- Files .createDirectories (postCheckoutHook .getParent ());
553- Files .write (postCheckoutHook , ("#!/bin/sh\n touch '" + jenkinsRootDir + "/hook-executed'\n " ).getBytes (StandardCharsets .UTF_8 ));
554- sampleRepoSvn .svnkit ("add" , sampleRepoSvn .wc () + "/vars" );
555- sampleRepoSvn .svnkit ("add" , sampleRepoSvn .wc () + "/.git" );
556- sampleRepoSvn .svnkit ("propset" , "svn:executable" , "ON" , sampleRepoSvn .wc () + "/.git/hooks/post-checkout" );
557- sampleRepoSvn .svnkit ("commit" , "--message=init" , sampleRepoSvn .wc ());
558- LibraryConfiguration folderLib = new LibraryConfiguration ("library" ,
559- new SCMSourceRetriever (new SubversionSCMSource (null , sampleRepoSvn .prjUrl ())));
560- folderLib .setDefaultVersion ("trunk" );
561- folderLib .setImplicit (true );
562- Folder f = r .jenkins .createProject (Folder .class , "folder1" );
563- f .getProperties ().add (new FolderLibraries (Collections .singletonList (folderLib )));
564- // Run the build using the folder library (which uses the SVN repo).
565- WorkflowJob p = f .createProject (WorkflowJob .class , "p" );
566- p .setDefinition (new CpsFlowDefinition ("foo()" , true ));
567- r .buildAndAssertSuccess (p );
568- // Delete the folder library, and rerun the build so the global library is used.
569- f .getProperties ().clear ();
570- WorkflowRun b2 = r .buildAndAssertSuccess (p );
571- assertFalse ("Git checkout should not execute hooks from SVN repo" , new File (r .jenkins .getRootDir (), "hook-executed" ).exists ());
572- }
573479}
0 commit comments