-
-
Notifications
You must be signed in to change notification settings - Fork 8.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[JENKINS-73129] Remove Windows path traversal escape hatch from SECURITY-2481 #9387
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
https://www.jenkins.io/security/advisory/2021-10-06/#SECURITY-2481 was published in October 2021 with an escape hatch that allows users to enable the path traversal vulnerability on Windows. Jetty 12 detects the vulernability even before the request reaches Jenkins and returns an HTTP error, as required by the Servlet API specification. Remove the escape hatch because the escape hatch is intended to be temporary and we don't want to reimplement the escape hatch within Jetty configuration. https://issues.jenkins.io/browse/JENKINS-73129 includes further discussion of the alternatives.
MarkEWaite
added
the
needs-security-review
Awaiting review by a security team member
label
Jun 13, 2024
basil
approved these changes
Jun 13, 2024
daniel-beck
approved these changes
Jun 13, 2024
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
MarkEWaite
added a commit
to MarkEWaite/jenkins.io
that referenced
this pull request
Jun 13, 2024
hudson.model.DirectoryBrowserSupport.allowAbsolutePath will be obsolete in the first weekly release after the merge of jenkinsci/jenkins#9387 Was not sure if this is the correct pattern to record a property that is no longer available. I tried to follow the pattern used by others in the file. Happy to adjust to whatever format or style is preferred.
daniel-beck
added
security-approved
@jenkinsci/core-security-review reviewed this PR for security issues
and removed
needs-security-review
Awaiting review by a security team member
labels
Jun 14, 2024
This PR is now ready for merge. We will merge it after approximately 24 hours if there is no negative feedback. /label ready-for-merge |
comment-ops-bot
bot
added
the
ready-for-merge
The PR is ready to go, and it will be merged soon if there is no negative feedback
label
Jun 14, 2024
MarkEWaite
added
removed
This PR removes a feature or a public API
rfe
For changelog: Minor enhancement. use `major-rfe` for changes to be highlighted
labels
Jun 14, 2024
MarkEWaite
changed the title
Remove SECURITY-2481 escape hatch for Windows path traversal
[JENKINS-73129] Remove SECURITY-2481 escape hatch for Windows path traversal
Jun 14, 2024
MarkEWaite
changed the title
[JENKINS-73129] Remove SECURITY-2481 escape hatch for Windows path traversal
[JENKINS-73129] Remove Windows path traversal escape hatch from SECURITY-2481
Jun 14, 2024
MarkEWaite
added
the
upgrade-guide-needed
This changes might be breaking in rare circumstances, an entry in the LTS upgrade guide is needed
label
Jun 14, 2024
MarkEWaite
added a commit
to jenkins-infra/jenkins.io
that referenced
this pull request
Jun 18, 2024
…ch is obsolete (#7362) * The hudson.model.DirectoryBrowserSupport.allowAbsolutePath is obsolete hudson.model.DirectoryBrowserSupport.allowAbsolutePath will be obsolete in the first weekly release after the merge of jenkinsci/jenkins#9387 Was not sure if this is the correct pattern to record a property that is no longer available. I tried to follow the pattern used by others in the file. Happy to adjust to whatever format or style is preferred. * Retain security and escape hatch in tags Co-authored-by: Daniel Beck <1831569+daniel-beck@users.noreply.github.com> * Remove "has been removed" That is already implied by the obsolete tag. No need to add the additional phrasing Co-authored-by: Daniel Beck <1831569+daniel-beck@users.noreply.github.com> --------- Co-authored-by: Daniel Beck <1831569+daniel-beck@users.noreply.github.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
ready-for-merge
The PR is ready to go, and it will be merged soon if there is no negative feedback
removed
This PR removes a feature or a public API
rfe
For changelog: Minor enhancement. use `major-rfe` for changes to be highlighted
security-approved
@jenkinsci/core-security-review reviewed this PR for security issues
upgrade-guide-needed
This changes might be breaking in rare circumstances, an entry in the LTS upgrade guide is needed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Remove Windows path traversal escape hatch from SECURITY-2481
SECURITY-2481 was published in October 2021 with an escape hatch that allows users to enable the path traversal vulnerability on Windows. Jetty 12 detects the vulernability even before the request reaches Jenkins and returns an HTTP error, as required by the Servlet API specification.
Remove the escape hatch because the escape hatch is intended to be temporary and we don't want to reimplement it for Jetty 12.
JENKINS-73129 includes further discussion of the alternatives.
Testing done
Confirmed that tests pass without the escape hatch.
Confirmed that there are no references to the escape hatch in the Jenkins GitHub organization other than the references removed in this pull request.
Proposed changelog entries
Proposed upgrade guidelines
hudson.model.DirectoryBrowserSupport.allowAbsolutePath
system property that allows the Windows path traversal vulnerability escape hatch has been removed. Users that rely on it will need to adapt their usage to no longer require the Windows path traversal vulnerability. No other workaround is planned. Refer to SECURITY-2481 for details.Submitter checklist
Desired reviewers
@daniel-beck
Happy to have suggestions for better text in the upgrade guide and in the changelog entry.
Before the changes are marked as
ready-for-merge
:Maintainer checklist