Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-34753

Sec-170-releated: gerrit-trigger needs to declare parameters

    XMLWordPrintable

    Details

    • Similar Issues:

      Description

      Injecting arbitrary parameters is now forbidden, so the plugin should declare them to the jobs.
      See https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11

      Major impacts:

      • Undeclared vars are not present anymore
      • log flooding with (list really contains all gerrit trigger vars):

      A workaround is possible by setting system properties.

      May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter
      
      Skipped parameter `GERRIT_EVENT_TYPE` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach
      
      May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter
      
      Skipped parameter `GERRIT_EVENT_HASH` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach
      
      May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter
      
      Skipped parameter `GERRIT_TOPIC` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach
      
      May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter
      
      Skipped parameter `GERRIT_CHANGE_NUMBER` as it is undefined on `ds-server test`. Set `-Dhudson.model.ParametersAction.keepUndefinedParameters`=true to allow undefined parameters to be injected as environment variables or `-Dhudson.model.ParametersAction.safeParameters=[comma-separated list]` to whitelist specific parameter names, even though it represents a security breach
      
      

      May 12, 2016 9:53:01 AM WARNING hudson.model.ParametersAction filter

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              rsandell rsandell
              Reporter:
              pedersen Björn Pedersen
              Votes:
              19 Vote for this issue
              Watchers:
              23 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved: