Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-34753

Sec-170-releated: gerrit-trigger needs to declare parameters

XMLWordPrintable

      Injecting arbitrary parameters is now forbidden, so the plugin should declare them to the jobs.
      See https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11

      Major impacts:

      • Undeclared vars are not present anymore
      • log flooding with (list really contains all gerrit trigger vars):

      A workaround is possible by setting system properties.

      May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter

Skipped parameter `GERRIT_EVENT_TYPE` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach

May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter

Skipped parameter `GERRIT_EVENT_HASH` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach

May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter

Skipped parameter `GERRIT_TOPIC` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach

May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter

Skipped parameter `GERRIT_CHANGE_NUMBER` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach

      May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter

          [JENKINS-34753] Sec-170-releated: gerrit-trigger needs to declare parameters

          Björn Pedersen created issue -
          Christopher Orr made changes -
          Labels New: security-170
          Aleksey LastName made changes -
          Status Original: Open [ 1 ] New: In Progress [ 3 ]
          Aleksey LastName made changes -
          Status Original: In Progress [ 3 ] New: Open [ 1 ]

          SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Robert Sandell
          Path:
          pom.xml
          http://jenkins-ci.org/commit/gerrit-trigger-plugin/b1c6b5242b94c802960a339a957e425b185ad7bd
          Log:
          Merge remote-tracking branch 'origin/master' into JENKINS-34753

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Robert Sandell Path: pom.xml http://jenkins-ci.org/commit/gerrit-trigger-plugin/b1c6b5242b94c802960a339a957e425b185ad7bd Log: Merge remote-tracking branch 'origin/master' into JENKINS-34753

          SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Robert Sandell
          Path:
          src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpander.java
          src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/EventListener.java
          src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/GerritTriggerParameters.java
          src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderParameterizedTest.java
          src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderSkipVoteParameterTest.java
          src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderTest.java
          src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/data/TriggerContextConverterTest.java
          http://jenkins-ci.org/commit/gerrit-trigger-plugin/3116820af823b0a2ee3613b03a5d0d2ca591e754
          Log:
          JENKINS-34753 Provide safe parameters to ParametersAction

          And fixed some checkstyle errors in the tests

          Compare: https://github.com/jenkinsci/gerrit-trigger-plugin/compare/c40227e06445...3116820af823

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Robert Sandell Path: src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpander.java src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/EventListener.java src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/GerritTriggerParameters.java src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderParameterizedTest.java src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderSkipVoteParameterTest.java src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderTest.java src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/data/TriggerContextConverterTest.java http://jenkins-ci.org/commit/gerrit-trigger-plugin/3116820af823b0a2ee3613b03a5d0d2ca591e754 Log: JENKINS-34753 Provide safe parameters to ParametersAction And fixed some checkstyle errors in the tests Compare: https://github.com/jenkinsci/gerrit-trigger-plugin/compare/c40227e06445...3116820af823
          rsandell made changes -
          Link New: This issue depends on JENKINS-34858 [ JENKINS-34858 ]

          ryan h added a comment -

          Any idea when this fix will be available via plugin update?

          ryan h added a comment - Any idea when this fix will be available via plugin update?
          Ilya Ashchepkov made changes -
          Link New: This issue is blocking JENKINS-35092 [ JENKINS-35092 ]

          SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Robert Sandell
          Path:
          pom.xml
          src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpander.java
          src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/EventListener.java
          src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/GerritCause.java
          src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/GerritTriggerParameters.java
          src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderParameterizedTest.java
          src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderSkipVoteParameterTest.java
          src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderTest.java
          src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/GerritProjectListTest.java
          src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/GerritTriggerTest.java
          src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/data/TriggerContextConverterTest.java
          http://jenkins-ci.org/commit/gerrit-trigger-plugin/8b4652554b63ec92768c4b8ad840cae0522d4c7d
          Log:
          Merge pull request #285 from jenkinsci/JENKINS-34753

          JENKINS-34753 Provide safe parameters to ParametersAction

          Compare: https://github.com/jenkinsci/gerrit-trigger-plugin/compare/644d75d4f7a5...8b4652554b63

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Robert Sandell Path: pom.xml src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpander.java src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/EventListener.java src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/GerritCause.java src/main/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/GerritTriggerParameters.java src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderParameterizedTest.java src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderSkipVoteParameterTest.java src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/gerritnotifier/ParameterExpanderTest.java src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/GerritProjectListTest.java src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/GerritTriggerTest.java src/test/java/com/sonyericsson/hudson/plugins/gerrit/trigger/hudsontrigger/data/TriggerContextConverterTest.java http://jenkins-ci.org/commit/gerrit-trigger-plugin/8b4652554b63ec92768c4b8ad840cae0522d4c7d Log: Merge pull request #285 from jenkinsci/ JENKINS-34753 JENKINS-34753 Provide safe parameters to ParametersAction Compare: https://github.com/jenkinsci/gerrit-trigger-plugin/compare/644d75d4f7a5...8b4652554b63

            rsandell rsandell
            pedersen Björn Pedersen
            Votes:
            19 Vote for this issue
            Watchers:
            23 Start watching this issue

              Created:
              Updated:
              Resolved: