Skip to content

Commit

Permalink
[SECURITY-1435]
Browse files Browse the repository at this point in the history
  • Loading branch information
@jtnord
jtnord committed Jul 26, 2019
1 parent d32dcfe commit a2e7f2b
Show file tree
Hide file tree
Showing 5 changed files with 89 additions and 8 deletions.
18 changes: 17 additions & 1 deletion pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,12 @@
<version>${maven.test.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.jenkins-ci</groupId>
<artifactId>test-annotations</artifactId>
<version>1.3</version>
<scope>test</scope>
</dependency>
</dependencies>

<build>
Expand All @@ -135,11 +141,21 @@
<artifactId>maven-hpi-plugin</artifactId>
<version>1.96</version>
<extensions>true</extensions>
<configuration>
<compatibleSinceVersion>0.15</compatibleSinceVersion>
</configuration>
</plugin>
<plugin>
<artifactId>maven-release-plugin</artifactId>
<version>2.5</version>
</plugin>
</plugin>
<plugin>
<artifactId>maven-compiler-plugin</artifactId>
<configuration>
<source>1.7</source>
<target>1.7</target>
</configuration>
</plugin>
</plugins>
</build>

Expand Down
15 changes: 8 additions & 7 deletions src/main/java/org/jvnet/hudson/plugins/m2release/M2ReleaseBuildWrapper.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@
import hudson.tasks.Builder;
import hudson.util.FormValidation;
import hudson.util.RunList;
import hudson.util.Secret;

import java.io.IOException;
import java.lang.reflect.Array;
Expand Down Expand Up @@ -189,7 +190,7 @@ public boolean tearDown(@SuppressWarnings("rawtypes") AbstractBuild bld, BuildLi
M2ReleaseArgumentsAction args = bld.getAction(M2ReleaseArgumentsAction.class);
if (args.isCloseNexusStage() && !args.isDryRun()) {
StageClient client = new StageClient(new URL(getDescriptor().getNexusURL()), getDescriptor()
.getNexusUser(), getDescriptor().getNexusPassword());
.getNexusUser(), getDescriptor().getNexusPassword().getPlainText());
try {
MavenModule rootModule = mmSet.getRootModule();
// TODO grab the version that we have just released...
Expand Down Expand Up @@ -475,7 +476,7 @@ public static class DescriptorImpl extends BuildWrapperDescriptor {
private boolean nexusSupport = false;
private String nexusURL = null;
private String nexusUser = "deployment"; //$NON-NLS-1$
private String nexusPassword = "deployment123"; //$NON-NLS-1$
private Secret nexusPassword = Secret.fromString("deployment123"); //$NON-NLS-1$



Expand Down Expand Up @@ -503,7 +504,7 @@ public boolean configure(StaplerRequest staplerRequest, JSONObject json) throws
nexusURL = nexusURL + "/";
}
nexusUser = Util.fixEmpty(nexusParams.getString("nexusUser")); //$NON-NLS-1$
nexusPassword = nexusParams.getString("nexusPassword"); //$NON-NLS-1$
nexusPassword = Secret.fromString(nexusParams.getString("nexusPassword")); //$NON-NLS-1$
}
save();
return true; // indicate that everything is good so far
Expand All @@ -525,7 +526,7 @@ public String getNexusUser() {
}


public String getNexusPassword() {
public Secret getNexusPassword() {
return nexusPassword;
}

Expand All @@ -539,8 +540,8 @@ public boolean isNexusSupport() {
*/
public FormValidation doUrlCheck(@QueryParameter String urlValue,
final @QueryParameter String usernameValue,
final @QueryParameter String passwordValue) throws IOException,
ServletException {
final @QueryParameter Secret passwordValue) throws IOException,
ServletException {
// this method can be used to check if a file exists anywhere in the file system,
// so it should be protected.
if (!Hudson.getInstance().hasPermission(Hudson.ADMINISTER)) {
Expand All @@ -564,7 +565,7 @@ public FormValidation doUrlCheck(@QueryParameter String urlValue,
if (!(url.getProtocol().equals("http") || url.getProtocol().equals("https"))) {
return FormValidation.error("protocol must be http or https");
}
StageClient client = new StageClient(new URL(testURL), usernameValue, passwordValue);
StageClient client = new StageClient(new URL(testURL), usernameValue, passwordValue.getPlainText());
client.checkAuthentication();
}
catch (MalformedURLException ex) {
Expand Down
55 changes: 55 additions & 0 deletions src/test/java/org/jvnet/hudson/plugins/m2release/M2ReleaseBuildWrapperTest.java
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
package org.jvnet.hudson.plugins.m2release;

import java.io.File;
import java.io.FileInputStream;
import java.nio.charset.StandardCharsets;

import org.apache.commons.io.IOUtils;
import org.junit.Rule;
import org.junit.Test;
import org.jvnet.hudson.test.Issue;
import org.jvnet.hudson.test.JenkinsRule;
import org.jvnet.hudson.test.recipes.LocalData;

import static org.hamcrest.CoreMatchers.containsString;
import static org.hamcrest.CoreMatchers.is;
import static org.hamcrest.CoreMatchers.not;
import static org.hamcrest.CoreMatchers.notNullValue;
import static org.junit.Assert.assertThat;
import static org.junit.Assert.fail;

public class M2ReleaseBuildWrapperTest {

private static final String PASSWORD = "mysecretpassword";
@Rule
public JenkinsRule jr = new JenkinsRule();


@Issue("SECURITY-1435")
@Test
@LocalData
public void testMigrationOfNexusPassword() throws Exception {
M2ReleaseBuildWrapper.DescriptorImpl d =
jr.jenkins.getDescriptorByType(M2ReleaseBuildWrapper.DescriptorImpl.class);
if (d == null) {
fail("could not find the descriptor");
}
assertThat("old password read ok", d.getNexusPassword(), notNullValue());
assertThat("old password migrated", d.getNexusPassword().getPlainText(), is(PASSWORD));

jr.configRoundtrip();

assertThat("round tripped password", d.getNexusPassword(), notNullValue());
assertThat("round tripped password", d.getNexusPassword().getPlainText(), is(PASSWORD));

File f = new File(jr.jenkins.root, M2ReleaseBuildWrapper.class.getName() + ".xml");
FileInputStream fis = new FileInputStream(f);
try {
String content = IOUtils.toString(fis, "UTF-8");
assertThat("password should be encrypted", content, not(containsString(PASSWORD)));
} finally {
fis.close();
}

}
}
2 changes: 2 additions & 0 deletions ...udson/plugins/m2release/M2ReleaseBuildWrapperTest/testMigrationOfNexusPassword/config.xml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
<?xml version='1.0' encoding='UTF-8'?>
<hudson/>
7 changes: 7 additions & 0 deletions ...testMigrationOfNexusPassword/org.jvnet.hudson.plugins.m2release.M2ReleaseBuildWrapper.xml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
<?xml version='1.0' encoding='UTF-8'?>
<org.jvnet.hudson.plugins.m2release.M2ReleaseBuildWrapper_-DescriptorImpl plugin="m2release@0.14.0">
<nexusSupport>true</nexusSupport>
<nexusURL>http://localhost:99/nexus/</nexusURL>
<nexusUser>myusername</nexusUser>
<nexusPassword>mysecretpassword</nexusPassword>
</org.jvnet.hudson.plugins.m2release.M2ReleaseBuildWrapper_-DescriptorImpl>

0 comments on commit a2e7f2b

Please sign in to comment.