Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-53753

Misleading documentation for permissions

XMLWordPrintable

      The plugin has an option to discover PRs from forks and only trust those with admin or write access. The documentation is misleading and makes it sound as thought this will block PRs from untrusted users from being built. Instead this causes the original Jenkinsfile to be used instead of the Jenkinsfile from the fork. Not only is the phrasing of the documentation misleading, it still allows for many vectors of attack such as changing a file that the original Jenkinsfile calls.

          [JENKINS-53753] Misleading documentation for permissions

          Andrew Bayer added a comment -

          Yeah, "trust" isn't well explained - it means, as you said, that changes to the Jenkinsfile in an untrusted branch will not be used, and the docs do say that, but not clearly enough to establish that it just means that and not that untrusted PRs won't be built at all. I think this and JENKINS-53752 should probably be addressed in tandem.

          Andrew Bayer added a comment - Yeah, "trust" isn't well explained - it means, as you said, that changes to the Jenkinsfile in an untrusted branch will not be used, and the docs do say that, but not clearly enough to establish that it just means that and not that untrusted PRs won't be built at all. I think this and JENKINS-53752 should probably be addressed in tandem.

          Jesse Glick added a comment -

          changing a file that the original Jenkinsfile calls

          Note that you can use readTrusted to load files that affect how the pipeline runs structurally. Provided you use one-off agents, changing other files could still be abused to waste resources but should not permit general escalations.

          Jesse Glick added a comment - changing a file that the original Jenkinsfile calls Note that you can use readTrusted to load files that affect how the pipeline runs structurally. Provided you use one-off agents, changing other files could still be abused to waste resources but should not permit general escalations.

            Unassigned Unassigned
            roguishmountain Sam Schwarz
            Votes:
            4 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated: