From d7e1a44a5b9d1e478e79b0bdbb43e74b08df35f3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 15 Apr 2024 16:44:16 +0000 Subject: [PATCH 1/7] Bump io.jenkins.tools.incrementals:git-changelist-maven-extension Bumps [io.jenkins.tools.incrementals:git-changelist-maven-extension](https://github.com/jenkinsci/incrementals-tools) from 1.7 to 1.8. - [Release notes](https://github.com/jenkinsci/incrementals-tools/releases) - [Commits](https://github.com/jenkinsci/incrementals-tools/compare/parent-1.7...parent-1.8) --- updated-dependencies: - dependency-name: io.jenkins.tools.incrementals:git-changelist-maven-extension dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .mvn/extensions.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml index 1f3636409..4e0774d51 100644 --- a/.mvn/extensions.xml +++ b/.mvn/extensions.xml @@ -2,6 +2,6 @@ io.jenkins.tools.incrementals git-changelist-maven-extension - 1.7 + 1.8 From b4da18d1fda6005cc560774e7d1ce8a13c2dbfcd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 4 Jun 2024 16:23:24 +0000 Subject: [PATCH 2/7] Bump org.jenkins-ci.plugins:plugin from 4.80 to 4.83 Bumps [org.jenkins-ci.plugins:plugin](https://github.com/jenkinsci/plugin-pom) from 4.80 to 4.83. - [Release notes](https://github.com/jenkinsci/plugin-pom/releases) - [Changelog](https://github.com/jenkinsci/plugin-pom/blob/master/CHANGELOG.md) - [Commits](https://github.com/jenkinsci/plugin-pom/compare/plugin-4.80...plugin-4.83) --- updated-dependencies: - dependency-name: org.jenkins-ci.plugins:plugin dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index d4839447e..702a3a91c 100644 --- a/pom.xml +++ b/pom.xml @@ -29,7 +29,7 @@ org.jenkins-ci.plugins plugin - 4.80 + 4.83 From 5a3f65a1e173a71486b2bd23da4523c1153a32ff Mon Sep 17 00:00:00 2001 From: Yaroslav Afenkin Date: Wed, 19 Jun 2024 10:52:02 +0300 Subject: [PATCH 3/7] [SECURITY-2495] --- .../plugins/credentials/SecretBytes.java | 15 +++++++++++++++ .../plugins/credentials/SecretBytesTest.java | 10 ++++++++++ 2 files changed, 25 insertions(+) diff --git a/src/main/java/com/cloudbees/plugins/credentials/SecretBytes.java b/src/main/java/com/cloudbees/plugins/credentials/SecretBytes.java index 1b7685b86..5e10cec61 100644 --- a/src/main/java/com/cloudbees/plugins/credentials/SecretBytes.java +++ b/src/main/java/com/cloudbees/plugins/credentials/SecretBytes.java @@ -244,7 +244,10 @@ public static byte[] getPlainData(@CheckForNull SecretBytes s) { * * @param data the data to wrap or decrypt. * @return never null + * + * @deprecated prefer {@link #fromRawBytes(byte[])} */ + @Deprecated public static SecretBytes fromBytes(byte[] data) { data = data == null ? new byte[0] : data; SecretBytes s = decrypt(data); @@ -254,6 +257,18 @@ public static SecretBytes fromBytes(byte[] data) { return s; } + + /** + * Unlike {@link #fromBytes(byte[])} this won't attempt to decrypt this as a secret. Always treat this as unencrypted bytes. + * + * @param data the data to wrap + * @return secret bytes + */ + public static SecretBytes fromRawBytes(byte[] data) { + data = data == null ? new byte[0] : data; + return new SecretBytes(false, data); + } + /** * Attempts to treat the given bytes first as a cipher text, and if it doesn't work, * treat the given string as the unencrypted BASE-64 encoded byte array. diff --git a/src/test/java/com/cloudbees/plugins/credentials/SecretBytesTest.java b/src/test/java/com/cloudbees/plugins/credentials/SecretBytesTest.java index 02c72f891..3c32b0158 100644 --- a/src/test/java/com/cloudbees/plugins/credentials/SecretBytesTest.java +++ b/src/test/java/com/cloudbees/plugins/credentials/SecretBytesTest.java @@ -29,6 +29,7 @@ import org.apache.commons.codec.binary.Base64; import org.apache.commons.lang.RandomStringUtils; import org.junit.Test; +import org.jvnet.hudson.test.Issue; import static org.hamcrest.MatcherAssert.assertThat; import static org.hamcrest.Matchers.containsString; @@ -48,6 +49,15 @@ public void encrypt() { assertThat(SecretBytes.fromBytes(secret.getEncryptedData()), is(secret)); } + @Issue("SECURITY-2495") + @Test + public void fromRawBytesNoPassThrough() { + SecretBytes secret = SecretBytes.fromRawBytes("aaaaaaaa\u0002ab".getBytes()); + assertThat(secret.getPlainData(), is("aaaaaaaa\u0002ab".getBytes())); + + assertThat(secret.getEncryptedData(), not(is("aaaaaaaa\u0002ab".getBytes()))); + } + @Test public void encryptedValuePattern() { Random entropy = new Random(); From 079a4cb90c9c5d8b2aad649874bb4f9a71771243 Mon Sep 17 00:00:00 2001 From: James Nord Date: Fri, 21 Jun 2024 10:49:59 +0100 Subject: [PATCH 4/7] Remove FileOnMasterKeySource and SECURITY-1322 migration It has been 5 years since the security fix was introduced and the migration code occureed. Whilst an admin could have still (ab)used the CLI/REST to set a FileOnMaster they could not do this from the UI creating a disparity. This change removes the migration and the ability to use this via CLI/REST --- pom.xml | 3 + .../impl/CertificateCredentialsImpl.java | 71 -------------- .../FileOnMasterKeyStoreSource/config.jelly | 50 ---------- .../config_de.properties | 23 ----- .../config_fr.properties | 23 ----- .../config_it.properties | 23 ----- .../config_ja.properties | 23 ----- .../help-keyStoreFile.html | 27 ------ .../help-keyStoreFile_fr.html | 27 ------ .../help-keyStoreFile_it.html | 3 - .../help-keyStoreFile_ja.html | 27 ------ .../impl/CertificateCredentialsImplTest.java | 95 ------------------- .../updateFolder.xml | 50 ---------- 13 files changed, 3 insertions(+), 442 deletions(-) delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config.jelly delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_de.properties delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_fr.properties delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_it.properties delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_ja.properties delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile.html delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_fr.html delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_it.html delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_ja.html delete mode 100644 src/test/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest/updateFolder.xml diff --git a/pom.xml b/pom.xml index d4839447e..9316d37fd 100644 --- a/pom.xml +++ b/pom.xml @@ -169,6 +169,9 @@ + + 1344 + org.antlr diff --git a/src/main/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl.java b/src/main/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl.java index 3b938c7c4..079249fd1 100644 --- a/src/main/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl.java +++ b/src/main/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl.java @@ -37,14 +37,10 @@ import hudson.util.FormValidation; import hudson.util.Secret; import java.io.ByteArrayInputStream; -import java.io.File; import java.io.IOException; import java.io.ObjectStreamException; import java.io.Serializable; import java.nio.charset.StandardCharsets; -import java.nio.file.Files; -import java.nio.file.InvalidPathException; -import java.nio.file.Paths; import java.security.KeyStore; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; @@ -58,7 +54,6 @@ import java.util.logging.LogRecord; import java.util.logging.Logger; -import jenkins.model.Jenkins; import net.jcip.annotations.GuardedBy; import org.apache.commons.fileupload.FileItem; import org.apache.commons.lang.StringUtils; @@ -337,72 +332,6 @@ protected static FormValidation validateCertificateKeystore(String type, byte[] } } - /** - * Let the user reference a file on the disk. - * @deprecated This approach has security vulnerabilities and should be migrated to {@link UploadedKeyStoreSource} - */ - @Deprecated - public static class FileOnMasterKeyStoreSource extends KeyStoreSource { - - /** - * Our logger. - */ - private static final Logger LOGGER = Logger.getLogger(FileOnMasterKeyStoreSource.class.getName()); - - /** - * The path of the file on the controller. - */ - private final String keyStoreFile; - - public FileOnMasterKeyStoreSource(String keyStoreFile) { - this.keyStoreFile = keyStoreFile; - } - - /** - * {@inheritDoc} - */ - @NonNull - @Override - public byte[] getKeyStoreBytes() { - try { - return Files.readAllBytes(Paths.get(keyStoreFile)); - } catch (IOException | InvalidPathException e) { - LOGGER.log(Level.WARNING, "Could not read private key file " + keyStoreFile, e); - return new byte[0]; - } - } - - /** - * {@inheritDoc} - */ - @Override - public long getKeyStoreLastModified() { - return new File(keyStoreFile).lastModified(); - } - - /** - * {@inheritDoc} - */ - @Override - public String toString() { - return "FileOnMasterKeyStoreSource{" + - "keyStoreFile='" + keyStoreFile + '\'' + - "}"; - } - - private Object readResolve() { - if (!Jenkins.get().hasPermission(Jenkins.RUN_SCRIPTS)) { - LOGGER.warning("SECURITY-1322: Permission failure migrating FileOnMasterKeyStoreSource to UploadedKeyStoreSource for a Certificate. An administrator may need to perform the migration."); - Jenkins.get().checkPermission(Jenkins.RUN_SCRIPTS); - } - - LOGGER.log(Level.INFO, "SECURITY-1322: Migrating FileOnMasterKeyStoreSource to UploadedKeyStoreSource. The containing item may need to be saved to complete the migration."); - SecretBytes secretBytes = SecretBytes.fromBytes(getKeyStoreBytes()); - return new UploadedKeyStoreSource(secretBytes); - } - - } - /** * Let the user reference an uploaded file. */ diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config.jelly b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config.jelly deleted file mode 100644 index da5225be3..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config.jelly +++ /dev/null @@ -1,50 +0,0 @@ - - - - - - - - - - - diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_de.properties b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_de.properties deleted file mode 100644 index 95deddfc5..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_de.properties +++ /dev/null @@ -1,23 +0,0 @@ -# The MIT License -# -# Copyright 2013 Harald Albers -# -# Permission is hereby granted, free of charge, to any person obtaining a copy -# of this software and associated documentation files (the "Software"), to deal -# in the Software without restriction, including without limitation the rights -# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -# copies of the Software, and to permit persons to whom the Software is -# furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -# THE SOFTWARE. - -File=Datei diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_fr.properties b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_fr.properties deleted file mode 100644 index 447e3dd3c..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_fr.properties +++ /dev/null @@ -1,23 +0,0 @@ -# The MIT License -# -# Copyright (c) 2014, Damien Finck -# -# Permission is hereby granted, free of charge, to any person obtaining a copy -# of this software and associated documentation files (the "Software"), to deal -# in the Software without restriction, including without limitation the rights -# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -# copies of the Software, and to permit persons to whom the Software is -# furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -# THE SOFTWARE. - -File=Fichier diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_it.properties b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_it.properties deleted file mode 100644 index c18289128..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_it.properties +++ /dev/null @@ -1,23 +0,0 @@ -# The MIT License -# -# Copyright 2020 Alessandro Menti -# -# Permission is hereby granted, free of charge, to any person obtaining a copy -# of this software and associated documentation files (the "Software"), to deal -# in the Software without restriction, including without limitation the rights -# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -# copies of the Software, and to permit persons to whom the Software is -# furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -# THE SOFTWARE. - -File=File diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_ja.properties b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_ja.properties deleted file mode 100644 index 2cb913591..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/config_ja.properties +++ /dev/null @@ -1,23 +0,0 @@ -# The MIT License -# -# Copyright 2013 Seiji Sogabe -# -# Permission is hereby granted, free of charge, to any person obtaining a copy -# of this software and associated documentation files (the "Software"), to deal -# in the Software without restriction, including without limitation the rights -# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -# copies of the Software, and to permit persons to whom the Software is -# furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -# THE SOFTWARE. - -File=\u30d5\u30a1\u30a4\u30eb \ No newline at end of file diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile.html b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile.html deleted file mode 100644 index f9e84ff6b..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile.html +++ /dev/null @@ -1,27 +0,0 @@ - - -
- The path to the file on the Jenkins controller. -
diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_fr.html b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_fr.html deleted file mode 100644 index 7f11398b4..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_fr.html +++ /dev/null @@ -1,27 +0,0 @@ - - -
- Le chemin vers le fichier sur le nœud maître Jenkins. -
\ No newline at end of file diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_it.html b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_it.html deleted file mode 100644 index 2a9e4bdda..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_it.html +++ /dev/null @@ -1,3 +0,0 @@ -
- Il percorso al file sul nodo master di Jenkins. -
diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_ja.html b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_ja.html deleted file mode 100644 index 410fe8c66..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/FileOnMasterKeyStoreSource/help-keyStoreFile_ja.html +++ /dev/null @@ -1,27 +0,0 @@ - - -
- Jenkinsのマスターノード上でのファイルのパスです。 -
\ No newline at end of file diff --git a/src/test/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest.java b/src/test/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest.java index 246228d64..2e8c02f0e 100644 --- a/src/test/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest.java +++ b/src/test/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest.java @@ -113,101 +113,6 @@ public void displayName() throws IOException { assertEquals(EXPECTED_DISPLAY_NAME, CredentialsNameProvider.name(new CertificateCredentialsImpl(null, "abc123", null, "password", storeSource))); } - @Test - @Issue("SECURITY-1322") - public void verifySystemMasterSourceConvertedToUploadedSource() throws Exception { - CertificateCredentialsImpl.FileOnMasterKeyStoreSource storeSource = new CertificateCredentialsImpl.FileOnMasterKeyStoreSource(p12.getAbsolutePath()); - CertificateCredentialsImpl credentials = new CertificateCredentialsImpl(null, "abc123", null, "password", storeSource); - SystemCredentialsProvider.getInstance().getCredentials().add(credentials); - SystemCredentialsProvider.getInstance().save(); - SystemCredentialsProvider provider = new SystemCredentialsProvider(); - Credentials reloadedCredentials = provider.getCredentials().get(0); - assertThat(reloadedCredentials, instanceOf(CertificateCredentials.class)); - CertificateCredentialsImpl.KeyStoreSource reloadedSource = ((CertificateCredentialsImpl) reloadedCredentials).getKeyStoreSource(); - assertThat(reloadedSource, instanceOf(CertificateCredentialsImpl.UploadedKeyStoreSource.class)); - provider.save(); - FilePath credentialsXml = r.getInstance().getRootPath().child("credentials.xml"); - String fileContents = credentialsXml.readToString(); - assertThat(fileContents, not(containsString("Master"))); - } - - @Test - @Issue("SECURITY-1322") - public void verifyGlobalMasterSourceConvertedToUploadedSource() throws Exception { - Folder folder = r.jenkins.createProject(Folder.class, "folder1"); - CertificateCredentialsImpl.FileOnMasterKeyStoreSource storeSource = new CertificateCredentialsImpl.FileOnMasterKeyStoreSource(p12.getAbsolutePath()); - CertificateCredentialsImpl credentials = new CertificateCredentialsImpl(null, "abc123", null, "password", storeSource); - CredentialsStore folderStore = getFolderStore(folder); - Domain domain = new Domain("test", "test", Collections.emptyList()); - folderStore.addDomain(domain, credentials); - folderStore.save(); - folder.doReload(); - CredentialsStore reloadedStore = getFolderStore(folder); - List reloadedCredentialsList = reloadedStore.getCredentials(domain); - assertThat(reloadedCredentialsList, hasSize(1)); - Credentials reloadedCredentials = reloadedCredentialsList.get(0); - CertificateCredentialsImpl.KeyStoreSource reloadedSource = ((CertificateCredentialsImpl) reloadedCredentials).getKeyStoreSource(); - assertThat(reloadedSource, instanceOf(CertificateCredentialsImpl.UploadedKeyStoreSource.class)); - reloadedStore.save(); - String configFileContent = folder.getConfigFile().asString(); - assertThat(configFileContent, not(containsString("Master"))); - } - - @Test - @Issue("SECURITY-1322") - @LocalData("updateFolder") - public void verifyUserWithoutRunScriptsCannotUploadMasterKeySource() throws Exception { - Folder folder = r.jenkins.createProject(Folder.class, "folder1"); - - FilePath updateFolder = r.jenkins.getRootPath().child("updateFolder.xml"); - CLICommandInvoker.Result result = new CLICommandInvoker(r, new UpdateJobCommand()) - .authorizedTo(Jenkins.READ, Job.READ, Job.CONFIGURE) - .withStdin(updateFolder.read()) - .invokeWithArgs("folder1"); - - assertThat(result.stderr(), containsString("user is missing the Overall/RunScripts permission")); - // 1 = means An error occurred, according to https://github.com/jenkinsci/jenkins/pull/1997/files#diff-4459859ade69b51edffdb58020f5d3f7R217 - assertThat(result, failedWith(1)); - - String configFileContent = folder.getConfigFile().asString(); - assertThat(configFileContent, not(containsString("Master"))); - } - - @Test - @Issue("SECURITY-1322") - @LocalData("updateFolder") - public void verifyUserWithRunScriptsCanUploadMasterKeySource() throws Exception { - Folder folder = r.jenkins.createProject(Folder.class, "folder1"); - - FilePath updateFolder = r.jenkins.getRootPath().child("updateFolder.xml"); - CLICommandInvoker.Result result = new CLICommandInvoker(r, new UpdateJobCommand()) - .authorizedTo(Jenkins.ADMINISTER) - .withStdin(updateFolder.read()) - .invokeWithArgs("folder1"); - - assertThat(result, succeeded()); - - Domain domain = new Domain("test", "test", Collections.emptyList()); - - // check the data is correctly updated in memory - CredentialsStore folderStore = getFolderStore(folder); - List credentialsList = folderStore.getCredentials(domain); - assertThat(credentialsList, hasSize(1)); - Credentials credentials = credentialsList.get(0); - CertificateCredentialsImpl.KeyStoreSource source = ((CertificateCredentialsImpl) credentials).getKeyStoreSource(); - assertThat(source, instanceOf(CertificateCredentialsImpl.UploadedKeyStoreSource.class)); - - folder.doReload(); - - // as well as after a reload - CredentialsStore reloadedFolderStore = getFolderStore(folder); - List reloadedCredentialsList = reloadedFolderStore.getCredentials(domain); - assertThat(reloadedCredentialsList, hasSize(1)); - Credentials reloadedCredentials = reloadedCredentialsList.get(0); - CertificateCredentialsImpl.KeyStoreSource reloadedSource = ((CertificateCredentialsImpl) reloadedCredentials).getKeyStoreSource(); - assertThat(reloadedSource, instanceOf(CertificateCredentialsImpl.UploadedKeyStoreSource.class)); - } - @Test @Issue("JENKINS-64542") public void doCheckUploadedKeystore_uploadedFileValid() throws Exception { diff --git a/src/test/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest/updateFolder.xml b/src/test/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest/updateFolder.xml deleted file mode 100644 index a8f0e5050..000000000 --- a/src/test/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImplTest/updateFolder.xml +++ /dev/null @@ -1,50 +0,0 @@ - - - - - - - - - - - - - - test - test - - - - - abc123 - - - /var/folders/1_/75tlch4x6297hbn2f2xl41hw0000gn/T/junit1296816016832319162/test.p12 - - Q+y6JDkS3krlY0cRvZ54ahQPQDOCauzcZ/W0Aw0eT5g= - - - - - - - - - - - All - false - false - - - - - - - - false - - - - \ No newline at end of file From 8b2dbcf8ee938fb2794a99deaed2cfe3915a9b72 Mon Sep 17 00:00:00 2001 From: James Nord Date: Fri, 21 Jun 2024 13:25:02 +0100 Subject: [PATCH 5/7] remove unused code --- .../impl/CertificateCredentialsImpl.java | 85 ------------------- .../Upload/complete.jelly | 36 -------- .../UploadedKeyStoreSource/Upload/index.jelly | 36 -------- .../Upload/index_de.properties | 25 ------ .../Upload/index_fr.properties | 25 ------ .../Upload/index_it.properties | 25 ------ .../Upload/index_ja.properties | 25 ------ 7 files changed, 257 deletions(-) delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/complete.jelly delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index.jelly delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_de.properties delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_fr.properties delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_it.properties delete mode 100644 src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_ja.properties diff --git a/src/main/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl.java b/src/main/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl.java index 3b938c7c4..b6f9e43d5 100644 --- a/src/main/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl.java +++ b/src/main/java/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl.java @@ -66,9 +66,7 @@ import org.kohsuke.accmod.Restricted; import org.kohsuke.accmod.restrictions.NoExternalUse; import org.kohsuke.stapler.DataBoundConstructor; -import org.kohsuke.stapler.HttpResponse; import org.kohsuke.stapler.QueryParameter; -import org.kohsuke.stapler.StaplerRequest; import org.kohsuke.stapler.interceptor.RequirePOST; public class CertificateCredentialsImpl extends BaseStandardCredentials implements StandardCertificateCredentials { @@ -612,89 +610,6 @@ public FormValidation doCheckUploadedKeystore(@QueryParameter String value, return validateCertificateKeystore("PKCS12", keystoreBytes, password); } - /** - * Creates a new {@link Upload} for the specified {@literal } - * - * @param divId the id if the form input element to inject the uploaded content into. - * @return the {@link Upload} - */ - @SuppressWarnings("unused") // invoked by stapler binding - @Restricted(NoExternalUse.class) - public Upload getUpload(String divId) { - return new Upload(divId, null); - } - - } - - /** - * Stapler binding object to handle a pop-up window for file upload. - * - * @deprecated since 2.4. This is no longer required/supported due to the inlining of the file input. - * Deprecated for removal soon. - */ - @Deprecated - public static class Upload { - - /** - * The id of the {@literal } element on the {@code window.opener} of the pop-up to inject the - * uploaded content into. - */ - @NonNull - private final String divId; - - /** - * The uploaded content. - */ - @CheckForNull - private final SecretBytes uploadedKeystore; - - /** - * Our constructor. - * - * @param divId id of the {@literal } element on the {@code window.opener} of the - * pop-up to inject the uploaded content into. - * @param uploadedKeystore the content. - */ - public Upload(@NonNull String divId, @CheckForNull SecretBytes uploadedKeystore) { - this.divId = divId; - this.uploadedKeystore = uploadedKeystore; - } - - /** - * Gets the id of the {@literal } element on the {@code window.opener} of the pop-up to inject the - * uploaded content into. - * - * @return the id of the {@literal } element on the {@code window.opener} of the pop-up to inject the - * uploaded content into. - */ - @NonNull - public String getDivId() { - return divId; - } - - /** - * Returns the content. - * - * @return the content. - */ - @CheckForNull - @SuppressWarnings("unused") // used by Jelly EL - public SecretBytes getUploadedKeystore() { - return uploadedKeystore; - } - - /** - * Performs the actual upload. - * - * @param req the request. - * @return the response. - */ - @NonNull - public HttpResponse doUpload(@NonNull StaplerRequest req) { - return FormValidation.ok("This endpoint is no longer required/supported due to the inlining of the file input. " + - "If you came to this endpoint due to another plugin, you will have to update that plugin to be compatible with Credentials Plugin 2.4+. " + - "It will be deleted soon."); - } } } diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/complete.jelly b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/complete.jelly deleted file mode 100644 index c03fd9134..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/complete.jelly +++ /dev/null @@ -1,36 +0,0 @@ - - - - - - - - View no longer required/supported due to the inlining of the file input. - If you came to this page due to another plugin, you will have to update that plugin to be compatible - with Credentials Plugin 2.4+ - It will be deleted soon. - - - \ No newline at end of file diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index.jelly b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index.jelly deleted file mode 100644 index c03fd9134..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index.jelly +++ /dev/null @@ -1,36 +0,0 @@ - - - - - - - - View no longer required/supported due to the inlining of the file input. - If you came to this page due to another plugin, you will have to update that plugin to be compatible - with Credentials Plugin 2.4+ - It will be deleted soon. - - - \ No newline at end of file diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_de.properties b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_de.properties deleted file mode 100644 index 8512f7a89..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_de.properties +++ /dev/null @@ -1,25 +0,0 @@ -# The MIT License -# -# Copyright 2013 Harald Albers -# -# Permission is hereby granted, free of charge, to any person obtaining a copy -# of this software and associated documentation files (the "Software"), to deal -# in the Software without restriction, including without limitation the rights -# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -# copies of the Software, and to permit persons to whom the Software is -# furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -# THE SOFTWARE. - -Upload\ PKCS\#12\ certificate=PKCS\#12-Zertifikat hochladen -Upload=Hochladen -Cancel=Abbrechen diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_fr.properties b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_fr.properties deleted file mode 100644 index e166a44cc..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_fr.properties +++ /dev/null @@ -1,25 +0,0 @@ -# The MIT License -# -# Copyright (c) 2014, Damien Finck -# -# Permission is hereby granted, free of charge, to any person obtaining a copy -# of this software and associated documentation files (the "Software"), to deal -# in the Software without restriction, including without limitation the rights -# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -# copies of the Software, and to permit persons to whom the Software is -# furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -# THE SOFTWARE. - -Upload\ PKCS\#12\ certificate=Chargement de certificat PKCS#12 -Upload=Chargement -Cancel=Annuler diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_it.properties b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_it.properties deleted file mode 100644 index c3c25cf48..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_it.properties +++ /dev/null @@ -1,25 +0,0 @@ -# The MIT License -# -# Copyright 2020 Alessandro Menti -# -# Permission is hereby granted, free of charge, to any person obtaining a copy -# of this software and associated documentation files (the "Software"), to deal -# in the Software without restriction, including without limitation the rights -# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -# copies of the Software, and to permit persons to whom the Software is -# furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -# THE SOFTWARE. - -Cancel=Annulla -Upload=Carica -Upload\ PKCS#12\ certificate=Carica certificato PKCS#12 diff --git a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_ja.properties b/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_ja.properties deleted file mode 100644 index 9851816ff..000000000 --- a/src/main/resources/com/cloudbees/plugins/credentials/impl/CertificateCredentialsImpl/UploadedKeyStoreSource/Upload/index_ja.properties +++ /dev/null @@ -1,25 +0,0 @@ -# The MIT License -# -# Copyright 2013 Seiji Sogabe -# -# Permission is hereby granted, free of charge, to any person obtaining a copy -# of this software and associated documentation files (the "Software"), to deal -# in the Software without restriction, including without limitation the rights -# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -# copies of the Software, and to permit persons to whom the Software is -# furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -# THE SOFTWARE. - -Upload\ PKCS\#12\ certificate=PKCS#12\u8a3c\u660e\u66f8\u306e\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9 -Upload=\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9 -Cancel=\u4e2d\u6b62 \ No newline at end of file From c9716dce845f0cf717ddcd303b8a7c99ba71fb56 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 1 Jul 2024 16:06:42 +0000 Subject: [PATCH 6/7] Bump org.jenkins-ci.plugins:plugin from 4.83 to 4.84 Bumps [org.jenkins-ci.plugins:plugin](https://github.com/jenkinsci/plugin-pom) from 4.83 to 4.84. - [Release notes](https://github.com/jenkinsci/plugin-pom/releases) - [Changelog](https://github.com/jenkinsci/plugin-pom/blob/master/CHANGELOG.md) - [Commits](https://github.com/jenkinsci/plugin-pom/compare/plugin-4.83...plugin-4.84) --- updated-dependencies: - dependency-name: org.jenkins-ci.plugins:plugin dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 702a3a91c..73249088a 100644 --- a/pom.xml +++ b/pom.xml @@ -29,7 +29,7 @@ org.jenkins-ci.plugins plugin - 4.83 + 4.84 From 74c696b8d7bdf07d421f6938a2b09ee76b0e3fdf Mon Sep 17 00:00:00 2001 From: James Nord Date: Tue, 2 Jul 2024 11:10:20 +0100 Subject: [PATCH 7/7] update compatibleSinceVersion --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 9316d37fd..b42f55a84 100644 --- a/pom.xml +++ b/pom.xml @@ -170,7 +170,7 @@ - 1344 + 1354