Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-28298

Can bypass the security check of authorize-project with CLI and REST of Jenkins 1.580.1

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Major Major
    • authorize-project-plugin
    • None
    • Jenkins 1.580.1
      authorize-project 1.0.3

      When running tests of authorize-project with Jenkins 1.580.1, tests failed as following:

      SpecificUsersAuthorizationStrategyTest.testCliFailure:689 Values should be different. Actual: 0
SpecificUsersAuthorizationStrategyTest.testRestInterfaceFailure:525 null

      This might mean you can bypass the security checks of authorize-project.

          [JENKINS-28298] Can bypass the security check of authorize-project with CLI and REST of Jenkins 1.580.1

          ikedam created issue -
          ikedam made changes -
          Link New: This issue is related to JENKINS-22469 [ JENKINS-22469 ]

          ikedam added a comment -

          Instructions to reproduce the problem are written in JENKINS-22469.

          REST API

          • Returns HTTP status code 200.
          • No exceptions are logged in the system log.
          • The updated configuration is not loaded into the memory (authorization configuration gets empty in the configuration page).
          • But the new configuration is saved to the disk.
          • When restarting Jenkins you can active the new configuration.

          CLI

          • The command exits with 0.
          • No exceptions are logged in the system log.
          • The updated configuration is not loaded into the memory (authorization configuration gets empty in the configuration page).
          • But the new configuration is saved to the disk.
          • When restarting Jenkins you can active the new configuration.

          ikedam added a comment - Instructions to reproduce the problem are written in JENKINS-22469 . REST API Returns HTTP status code 200. No exceptions are logged in the system log. The updated configuration is not loaded into the memory (authorization configuration gets empty in the configuration page). But the new configuration is saved to the disk. When restarting Jenkins you can active the new configuration. CLI The command exits with 0. No exceptions are logged in the system log. The updated configuration is not loaded into the memory (authorization configuration gets empty in the configuration page). But the new configuration is saved to the disk. When restarting Jenkins you can active the new configuration.

          ikedam added a comment -
          Jenkins version Test result
          1.532 Success
          1.543 Success
          1.544 Success
          1.545 Faulure
          1.548 Failure
          1.554 Failure

          ikedam added a comment - Jenkins version Test result 1.532 Success 1.543 Success 1.544 Success 1.545 Faulure 1.548 Failure 1.554 Failure

          ikedam added a comment -

          Might be broken for JENKINS-21024.
          It is also ported to Jenkins-1.532.3.

          ikedam added a comment - Might be broken for JENKINS-21024 . It is also ported to Jenkins-1.532.3.

          ikedam added a comment - - edited

          RobustReflectionConverter#addCriticalField introduced in SECURITY-107, 622e39f, Jenkins 1.551 (and backported to 1.532.2) will help me.

          ikedam added a comment - - edited RobustReflectionConverter#addCriticalField introduced in SECURITY-107, 622e39f , Jenkins 1.551 (and backported to 1.532.2) will help me.

          ikedam added a comment -

          Even I set the field critical, RobustReflectionConverter gets to throw an exception but CopyOnWriteList squashes the exception.
          c350811

          ikedam added a comment - Even I set the field critical, RobustReflectionConverter gets to throw an exception but CopyOnWriteList squashes the exception. c350811

          ikedam added a comment -

          Throwing RuntimeException or Error don't help. Any exceptions are wrapped with InvocationTargetException by Java reflection and wrapped with XStreamException by xstream.

          ikedam added a comment - Throwing RuntimeException or Error don't help. Any exceptions are wrapped with InvocationTargetException by Java reflection and wrapped with XStreamException by xstream.
          ikedam made changes -
          Link New: This issue depends on JENKINS-28440 [ JENKINS-28440 ]

          ikedam added a comment -

          I'll introduce a feature like https://wiki.jenkins-ci.org/display/JENKINS/Extensible+Choice+Parameter+plugin#ExtensibleChoiceParameterplugin-Disablingproviders

          ikedam added a comment - I'll introduce a feature like https://wiki.jenkins-ci.org/display/JENKINS/Extensible+Choice+Parameter+plugin#ExtensibleChoiceParameterplugin-Disablingproviders

            ikedam ikedam
            ikedam ikedam
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: