Details
-
Improvement
-
Status: Resolved (View Workflow)
-
Minor
-
Resolution: Fixed
-
None
-
Jenkins >= 1.545
Description
Plugins could reject configurations via REST and CLI in Jenkins < 1.545 by throwing exceptions in readResolve.
Authorize Project plugin performs authentications with this behavior.
Jenkins 1.545 suppresses exceptions in readResolve in JENKINS-21024 (also backported to Jenkins 1.532.3).
This results that throwing exceptions in readResolve prevents reading configurations into memories via REST / CLI but cannot prevents saving them to the disk.
Authorize-project doesn't perform authentications when Jenkins reads configurations from the disk and allows bypassing authentications.
Jenkins 1.551 introduced XStream2#addCriticalField in SECURITY-107 (also backported to Jenkins 1.532.2) which triggers critical errors by exceptions in readResolve but only applied to system configurations, not applied project configurations via REST / CLI. (Exceptions are suppressed in CopyOnWriteList)
Jenkins should provides a way for plugins to reject configurations via REST / CLI.
Attachments
Issue Links
- is blocking
-
JENKINS-28298 Can bypass the security check of authorize-project with CLI and REST of Jenkins 1.580.1
-
- Closed
-
- is related to
-
JENKINS-21024 Miscellaneous exceptions in config.xml can prevent entire job from loading
-
- Resolved
-
Integrated in
jenkins_main_trunk #4250
JENKINS-28440Added tests to reproduce and explainJENKINS-28440. (Revision be67b45a31f2987dd20cdbdfd4b4997f5250d66f)[FIXED JENKINS-28440] Raises a critical exception for an error in a critical field. This allows plugins to reject unacceptable configurations via REST / CLI. (Revision 2082b08e2a0e54856370af9e3dda342475dff334)
JENKINS-28440Updates tests forJENKINS-28440to verify behaviors of UI. (Revision 7958928aedab9695379f17e6462f8b8236910497)Result = SUCCESS
devld : be67b45a31f2987dd20cdbdfd4b4997f5250d66f
Files :
devld : 2082b08e2a0e54856370af9e3dda342475dff334
Files :
devld : 7958928aedab9695379f17e6462f8b8236910497
Files :