Fix SECURITY-1025 #11
Conversation
Done |
lacostej
force-pushed
the
SECURITY-1025
branch
from
9b2f015 to
49a1a8d
Compare
|
I think I now have handled all cases that needed to be handled. 
|
| @@ -264,6 +265,7 @@ public Object getDynamic(String token, StaplerRequest req, StaplerResponse rsp) | |||
| /** | |||
| * Schedules the execution | |||
| */ | |||
| @POST | |||
There was a problem hiding this comment.
With addition of these annotations UI buttons seem to be broken.
I've create a dummy freestyle job and added 2 batch tasks to it. Then when I go to JENKINS/job/JOB_NAME/batchTasks/task/TASK_NAME/ and click "Build Now" I get a 404. Same with "Delete Task".
I suspect that culprits are https://github.com/jenkinsci/batch-task-plugin/blob/master/src/main/resources/hudson/plugins/batch_task/BatchTask/sidepanel.jelly#L18 and https://github.com/jenkinsci/batch-task-plugin/blob/master/src/main/resources/hudson/plugins/batch_task/BatchTask/delete.jelly#L9C11-L9C23
For l:task there exists a post attribute, so the fix should be straightforward.
There was a problem hiding this comment.
perfect. Note that I removed the delete.jelly as it does no seem to be used.
I am still able to delete tasks without it.
| * @param expectedStatus if expecting a failing http status code or null if not | ||
| * @throws IOException if so | ||
| */ | ||
| public static HtmlPage post(JenkinsRule.WebClient webClient, String relative, |
There was a problem hiding this comment.
FYI utility methods exist in jenkins-test-harness that allow you to send post requests already.
See https://github.com/jenkinsci/jenkins/blob/9012a5b35aca298e4cfa23c6ca95242690c232c3/test/src/test/java/hudson/model/ViewTest.java#L264-L267 for example.
There was a problem hiding this comment.
Thanks, I adjusted my helper method.
lacostej
force-pushed
the
SECURITY-1025
branch
from
d5e0dc2 to
7eb6d97
Compare
| @@ -326,6 +327,7 @@ public String getUrlName() { | |||
| /** | |||
| * Handles incremental log output. | |||
| */ | |||
| @POST | |||
There was a problem hiding this comment.
This is not really needed, no CSRF here.
I hope this fixes SECURITY-1025. Any way to check if there are other paths to protect?
Testing done
Submitter checklist