Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-34753

Sec-170-releated: gerrit-trigger needs to declare parameters

XMLWordPrintable

      Injecting arbitrary parameters is now forbidden, so the plugin should declare them to the jobs.
      See https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11

      Major impacts:

      • Undeclared vars are not present anymore
      • log flooding with (list really contains all gerrit trigger vars):

      A workaround is possible by setting system properties.

      May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter

Skipped parameter `GERRIT_EVENT_TYPE` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach

May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter

Skipped parameter `GERRIT_EVENT_HASH` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach

May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter

Skipped parameter `GERRIT_TOPIC` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach

May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter

Skipped parameter `GERRIT_CHANGE_NUMBER` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach

      May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter

          [JENKINS-34753] Sec-170-releated: gerrit-trigger needs to declare parameters

          Björn Pedersen created issue -
          Christopher Orr made changes -
          Labels New: security-170
          Aleksey LastName made changes -
          Status Original: Open [ 1 ] New: In Progress [ 3 ]
          Aleksey LastName made changes -
          Status Original: In Progress [ 3 ] New: Open [ 1 ]
          rsandell made changes -
          Link New: This issue depends on JENKINS-34858 [ JENKINS-34858 ]
          Ilya Ashchepkov made changes -
          Link New: This issue is blocking JENKINS-35092 [ JENKINS-35092 ]
          rsandell made changes -
          Resolution New: Fixed [ 1 ]
          Status Original: Open [ 1 ] New: Resolved [ 5 ]
          R. Tyler Croy made changes -
          Workflow Original: JNJira [ 170935 ] New: JNJira + In-Review [ 198988 ]

            rsandell rsandell
            pedersen Björn Pedersen
            Votes:
            19 Vote for this issue
            Watchers:
            23 Start watching this issue

              Created:
              Updated:
              Resolved: