Skip to content

Commit 1ea2ffe

Browse files
jimklimovjimklimov
authored
Merge branch 'master' into logging-exMTL
2 parents 337cc4e + 5b32b1a commit 1ea2ffe

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+1352
-271
lines changed

‎.github/workflows/jenkins-security-scan.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Jenkins Security Scan
2+
3+
on:
4+
push:
5+
branches:
6+
- master
7+
pull_request:
8+
types: [ opened, synchronize, reopened ]
9+
workflow_dispatch:
10+
11+
permissions:
12+
security-events: write
13+
contents: read
14+
actions: read
15+
16+
jobs:
17+
security-scan:
18+
uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@v2
19+
with:
20+
java-cache: 'maven' # Optionally enable use of a build dependency cache. Specify 'maven' or 'gradle' as appropriate.

‎.mvn/extensions.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@
22
<extension>
33
<groupId>io.jenkins.tools.incrementals</groupId>
44
<artifactId>git-changelist-maven-extension</artifactId>
5-
<version>1.7</version>
5+
<version>1.8</version>
66
</extension>
77
</extensions>

‎Jenkinsfile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,8 @@ https://github.com/jenkins-infra/pipeline-library/
55
66
*/
77
buildPlugin(
8-
useContainerAgent: true, // Set to `false` if you need to use Docker for containerized tests
8+
forkCount: '1C',
9+
useContainerAgent: true,
910
configurations: [
1011
[platform: 'linux', jdk: 21],
1112
[platform: 'windows', jdk: 17],

‎lib/pom.xml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@
5050
<plugin>
5151
<groupId>org.codehaus.mojo</groupId>
5252
<artifactId>exec-maven-plugin</artifactId>
53-
<version>3.2.0</version>
53+
<version>3.5.0</version>
5454
<executions>
5555
<execution>
5656
<phase>generate-sources</phase>
@@ -61,6 +61,8 @@
6161
<sourceRoot>${project.build.directory}/generated-sources/dgm</sourceRoot>
6262
<executable>java</executable>
6363
<arguments>
64+
<!-- Workaround for CodeQL support on JDK17+, see https://github.com/jenkinsci/workflow-cps-plugin/pull/901. -->
65+
<argument>--add-opens=jdk.compiler/com.sun.tools.javac.file=ALL-UNNAMED</argument>
6466
<argument>-jar</argument>
6567
<argument>${project.build.directory}/groovy-cps-dgm-builder-${project.version}-jar-with-dependencies.jar</argument>
6668
<argument>${project.build.directory}/generated-sources/dgm</argument>

‎plugin/pom.xml‎

Lines changed: 15 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -49,8 +49,8 @@
4949
<dependencies>
5050
<dependency>
5151
<groupId>io.jenkins.tools.bom</groupId>
52-
<artifactId>bom-2.414.x</artifactId>
53-
<version>2982.vdce2153031a_0</version>
52+
<artifactId>bom-${jenkins.baseline}.x</artifactId>
53+
<version>4023.va_eeb_b_4e45f07</version>
5454
<scope>import</scope>
5555
<type>pom</type>
5656
</dependency>
@@ -80,7 +80,6 @@
8080
<dependency>
8181
<groupId>org.jenkins-ci.plugins</groupId>
8282
<artifactId>script-security</artifactId>
83-
<version>1336.vf33a_a_9863911</version>
8483
</dependency>
8584
<dependency>
8685
<groupId>org.jenkins-ci.plugins</groupId>
@@ -225,47 +224,32 @@
225224
<scope>test</scope>
226225
</dependency>
227226
<dependency>
228-
<groupId>org.jenkins-ci.plugins</groupId>
229-
<artifactId>subversion</artifactId>
227+
<groupId>org.testcontainers</groupId>
228+
<artifactId>testcontainers</artifactId>
229+
<version>1.20.4</version>
230230
<scope>test</scope>
231231
<exclusions>
232+
<!-- Provided by Jenkins core -->
232233
<exclusion>
233-
<groupId>org.apache.sshd</groupId>
234-
<artifactId>sshd-common</artifactId>
235-
</exclusion>
236-
<exclusion>
237-
<groupId>org.apache.sshd</groupId>
238-
<artifactId>sshd-core</artifactId>
234+
<groupId>org.slf4j</groupId>
235+
<artifactId>slf4j-api</artifactId>
239236
</exclusion>
240237
</exclusions>
241238
</dependency>
242239
<dependency>
243-
<groupId>org.jenkins-ci.plugins</groupId>
244-
<artifactId>subversion</artifactId>
245-
<classifier>tests</classifier>
240+
<groupId>org.awaitility</groupId>
241+
<artifactId>awaitility</artifactId>
242+
<version>4.2.2</version>
246243
<scope>test</scope>
247244
</dependency>
248245
<dependency>
249-
<groupId>org.testcontainers</groupId>
250-
<artifactId>testcontainers</artifactId>
251-
<version>1.19.7</version>
246+
<groupId>io.jenkins</groupId>
247+
<artifactId>configuration-as-code</artifactId>
252248
<scope>test</scope>
253-
<exclusions>
254-
<!-- Provided by Jenkins core -->
255-
<exclusion>
256-
<groupId>org.apache.commons</groupId>
257-
<artifactId>commons-compress</artifactId>
258-
</exclusion>
259-
<exclusion>
260-
<groupId>org.slf4j</groupId>
261-
<artifactId>slf4j-api</artifactId>
262-
</exclusion>
263-
</exclusions>
264249
</dependency>
265250
<dependency>
266-
<groupId>org.tmatesoft.svnkit</groupId>
267-
<artifactId>svnkit-cli</artifactId>
268-
<version>1.10.10</version>
251+
<groupId>io.jenkins.configuration-as-code</groupId>
252+
<artifactId>test-harness</artifactId>
269253
<scope>test</scope>
270254
</dependency>
271255
</dependencies>

‎plugin/src/main/java/org/jenkinsci/plugins/workflow/cps/CpsBodyExecution.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,9 @@ public boolean cancel(Throwable error) {
249249
t.getExecution().runInCpsVmThread(new FutureCallback<>() {
250250
@Override
251251
public void onSuccess(CpsThreadGroup g) {
252+
if (thread == null) {
253+
return;
254+
}
252255
// Similar to getCurrentExecutions but we want the raw CpsThread, not a StepExecution; cf. CpsFlowExecution.interrupt
253256
Map<FlowHead, CpsThread> m = new LinkedHashMap<>();
254257
for (CpsThread t : thread.group.getThreads()) {
@@ -357,6 +360,9 @@ public Next receive(Object o) {
357360
sc.onFailure(t);
358361
}
359362
}
363+
synchronized (CpsBodyExecution.this) {
364+
thread = null;
365+
}
360366
return Next.terminate(null);
361367
}
362368

@@ -377,6 +383,9 @@ public Next receive(Object o) {
377383
sc.onFailure(e);
378384
}
379385
}
386+
synchronized (CpsBodyExecution.this) {
387+
thread = null;
388+
}
380389
return Next.terminate(null);
381390
}
382391

‎plugin/src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java‎

Lines changed: 36 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,16 +24,22 @@
2424

2525
package org.jenkinsci.plugins.workflow.cps;
2626

27+
import edu.umd.cs.findbugs.annotations.CheckForNull;
2728
import edu.umd.cs.findbugs.annotations.NonNull;
29+
import hudson.AbortException;
2830
import hudson.Extension;
31+
import hudson.Util;
2932
import hudson.model.Action;
33+
import hudson.model.Descriptor;
34+
import hudson.model.Failure;
3035
import hudson.model.Item;
3136
import hudson.model.Job;
3237
import hudson.model.Queue;
3338
import hudson.model.Run;
3439
import hudson.model.TaskListener;
3540
import hudson.util.FormValidation;
3641
import hudson.util.StreamTaskListener;
42+
import jenkins.model.Jenkins;
3743
import net.sf.json.JSONObject;
3844
import org.apache.commons.lang.StringUtils;
3945
import org.jenkinsci.plugins.workflow.cps.persistence.PersistIn;
@@ -43,6 +49,8 @@
4349
import org.jenkinsci.plugins.workflow.flow.FlowDurabilityHint;
4450
import org.jenkinsci.plugins.workflow.flow.FlowExecutionOwner;
4551
import org.jenkinsci.plugins.workflow.flow.GlobalDefaultFlowDurabilityLevel;
52+
import org.kohsuke.accmod.Restricted;
53+
import org.kohsuke.accmod.restrictions.NoExternalUse;
4654
import org.kohsuke.stapler.AncestorInPath;
4755
import org.kohsuke.stapler.DataBoundConstructor;
4856

@@ -61,6 +69,7 @@
6169
import org.kohsuke.stapler.QueryParameter;
6270
import org.kohsuke.stapler.Stapler;
6371
import org.kohsuke.stapler.StaplerRequest;
72+
import org.kohsuke.stapler.StaplerRequest2;
6473
import org.kohsuke.stapler.interceptor.RequirePOST;
6574

6675
/**
@@ -75,13 +84,14 @@ public class CpsFlowDefinition extends FlowDefinition {
7584
* @deprecated use {@link #CpsFlowDefinition(String, boolean)} instead
7685
*/
7786
@Deprecated
78-
public CpsFlowDefinition(String script) {
87+
public CpsFlowDefinition(String script) throws Descriptor.FormException {
7988
this(script, false);
8089
}
8190

8291
@DataBoundConstructor
83-
public CpsFlowDefinition(String script, boolean sandbox) {
84-
StaplerRequest req = Stapler.getCurrentRequest();
92+
public CpsFlowDefinition(String script, boolean sandbox) throws Descriptor.FormException {
93+
ScriptApproval.validateSandbox(sandbox);
94+
StaplerRequest2 req = Stapler.getCurrentRequest2();
8595
this.script = sandbox ? script : ScriptApproval.get().configuring(script, GroovyLanguage.get(),
8696
ApprovalContext.create().withCurrentUser().withItemAsKey(req != null ? req.findAncestorObject(Item.class) : null), req == null);
8797
this.sandbox = sandbox;
@@ -138,8 +148,26 @@ public static class DescriptorImpl extends FlowDefinitionDescriptor {
138148
* @DataBoundSetters have been invoked (rather than in the @DataBoundConstructor), which is why we use Descriptor.newInstance.
139149
*/
140150
@Override
151+
public FlowDefinition newInstance(@NonNull StaplerRequest2 req, @NonNull JSONObject formData) throws FormException {
152+
if (Util.isOverridden(FlowDefinitionDescriptor.class, getClass(), "newInstance", StaplerRequest.class, JSONObject.class)) {
153+
return newInstance(StaplerRequest.fromStaplerRequest2(req), formData);
154+
} else {
155+
CpsFlowDefinition cpsFlowDefinition = (CpsFlowDefinition) super.newInstance(req, formData);
156+
return newInstanceImpl(cpsFlowDefinition, req, formData);
157+
}
158+
}
159+
160+
/**
161+
* @deprecated use {@link #newInstance(StaplerRequest2, JSONObject)}
162+
*/
163+
@Deprecated
164+
@Override
141165
public FlowDefinition newInstance(@NonNull StaplerRequest req, @NonNull JSONObject formData) throws FormException {
142166
CpsFlowDefinition cpsFlowDefinition = (CpsFlowDefinition) super.newInstance(req, formData);
167+
return newInstanceImpl(cpsFlowDefinition, StaplerRequest.toStaplerRequest2(req), formData);
168+
}
169+
170+
private FlowDefinition newInstanceImpl(CpsFlowDefinition cpsFlowDefinition, @NonNull StaplerRequest2 req, @NonNull JSONObject formData) {
143171
if (!cpsFlowDefinition.sandbox && formData.get("oldScript") != null) {
144172
String oldScript = formData.getString("oldScript");
145173
boolean approveIfAdmin = !StringUtils.equals(oldScript, cpsFlowDefinition.script);
@@ -178,5 +206,10 @@ public JSON doCheckScriptCompile(@AncestorInPath Item job, @QueryParameter Strin
178206
// Approval requirements are managed by regular stapler form validation (via doCheckScript)
179207
}
180208

209+
@Restricted(NoExternalUse.class) // stapler
210+
public boolean shouldHideSandbox(@CheckForNull CpsFlowDefinition instance) {
211+
return ScriptApproval.shouldHideSandbox(instance, CpsFlowDefinition::isSandbox);
212+
}
213+
181214
}
182215
}

0 commit comments

Comments
 (0)