OpenSource/jenkins
1
0 Fork 0
mirror of https://github.com/jenkinsci/jenkins.git synced 2026-11-03 15:15:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'security-stable-2.46' into security-stable-2.60

Browse Source
This commit is contained in:
Jesse Glick committed 2018-02-08 15:39:10 +01:00
2 parents 00bf01eb17 8830d68f5f
commit 4aa29f8b37
2 files changed
+5 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

core/src/main/java/hudson/Plugin.java
+3 -1
View File
@@ -44,6 +44,7 @@ import com.thoughtworks.xstream.XStream;
import hudson.init.Initializer;
import hudson.init.Terminator;
import java.net.URL;
import java.util.Locale;
import java.util.logging.Logger;
import jenkins.model.GlobalConfiguration;
@@ -226,7 +227,8 @@ public abstract class Plugin implements Saveable {
public void doDynamic(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
String path = req.getRestOfPath();
if (path.isEmpty() || path.contains("..") || path.contains("%") || path.contains("META-INF") || path.contains("WEB-INF")) {
String pathUC = path.toUpperCase(Locale.ENGLISH);
if (path.isEmpty() || path.contains("..") || path.contains("%") || pathUC.contains("META-INF") || pathUC.contains("WEB-INF")) {
LOGGER.warning("rejecting possibly malicious " + req.getRequestURIWithQueryString());
rsp.sendError(HttpServletResponse.SC_BAD_REQUEST);
return;