From 416fdddb97f8a6f8778a66bfe38d5eb39a77149c Mon Sep 17 00:00:00 2001 From: Daniel Beck Date: Fri, 14 Apr 2017 22:45:57 +0200 Subject: [PATCH 1/4] [SECURITY-420] RequirePOST to finish setup wizard --- core/src/main/java/jenkins/install/SetupWizard.java | 1 + war/src/main/js/api/pluginManager.js | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/jenkins/install/SetupWizard.java b/core/src/main/java/jenkins/install/SetupWizard.java index 2d98160b9b..0f3567ff9f 100644 --- a/core/src/main/java/jenkins/install/SetupWizard.java +++ b/core/src/main/java/jenkins/install/SetupWizard.java @@ -443,6 +443,7 @@ public class SetupWizard extends PageDecorator { /** * Remove the setupWizard filter, ensure all updates are written to disk, etc */ + @RequirePOST public HttpResponse doCompleteInstall() throws IOException, ServletException { completeSetup(); return HttpResponses.okJSON(); diff --git a/war/src/main/js/api/pluginManager.js b/war/src/main/js/api/pluginManager.js index 3f2cf7fedb..1af7995c1b 100644 --- a/war/src/main/js/api/pluginManager.js +++ b/war/src/main/js/api/pluginManager.js @@ -177,7 +177,7 @@ exports.incompleteInstallStatus = function(handler, correlationId) { * Call this to complete the installation without installing anything */ exports.completeInstall = function(handler) { - jenkins.get('/setupWizard/completeInstall', function() { + jenkins.post('/setupWizard/completeInstall', {}, function() { handler.call({ isError: false }); }, { timeout: pluginManagerErrorTimeoutMillis, From eaafedd2ddad80e723403dd0126dd635001bb51e Mon Sep 17 00:00:00 2001 From: Daniel Beck Date: Fri, 14 Apr 2017 19:39:59 +0200 Subject: [PATCH 2/4] [SECURITY-420] Add more @RequirePOST annotations --- core/src/main/java/hudson/lifecycle/WindowsInstallerLink.java | 3 +++ core/src/main/java/hudson/logging/LogRecorderManager.java | 1 + core/src/main/java/hudson/model/MyViewsProperty.java | 2 ++ core/src/main/java/hudson/model/TaskAction.java | 2 ++ core/src/main/java/hudson/model/UpdateSite.java | 1 + core/src/main/java/hudson/slaves/AbstractCloudComputer.java | 2 ++ core/src/main/java/hudson/util/DoubleLaunchChecker.java | 2 ++ core/src/main/java/jenkins/diagnosis/HsErrPidFile.java | 2 ++ .../main/resources/hudson/util/DoubleLaunchChecker/index.jelly | 2 +- 9 files changed, 16 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/hudson/lifecycle/WindowsInstallerLink.java b/core/src/main/java/hudson/lifecycle/WindowsInstallerLink.java index 4401b43649..a320cca0bb 100644 --- a/core/src/main/java/hudson/lifecycle/WindowsInstallerLink.java +++ b/core/src/main/java/hudson/lifecycle/WindowsInstallerLink.java @@ -46,6 +46,7 @@ import org.apache.tools.ant.taskdefs.Move; import org.apache.tools.ant.Project; import org.apache.tools.ant.DefaultLogger; import org.apache.tools.ant.types.FileSet; +import org.kohsuke.stapler.interceptor.RequirePOST; import javax.servlet.ServletException; import java.io.File; @@ -105,6 +106,7 @@ public class WindowsInstallerLink extends ManagementLink { /** * Performs installation. */ + @RequirePOST public void doDoInstall(StaplerRequest req, StaplerResponse rsp, @QueryParameter("dir") String _dir) throws IOException, ServletException { if(installationDir!=null) { // installation already complete @@ -166,6 +168,7 @@ public class WindowsInstallerLink extends ManagementLink { } } + @RequirePOST public void doRestart(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException { if(installationDir==null) { // if the user reloads the page after Hudson has restarted, diff --git a/core/src/main/java/hudson/logging/LogRecorderManager.java b/core/src/main/java/hudson/logging/LogRecorderManager.java index e35a098d4b..21fdd155de 100644 --- a/core/src/main/java/hudson/logging/LogRecorderManager.java +++ b/core/src/main/java/hudson/logging/LogRecorderManager.java @@ -130,6 +130,7 @@ public class LogRecorderManager extends AbstractModelObject implements ModelObje * Configure the logging level. */ @edu.umd.cs.findbugs.annotations.SuppressWarnings("LG_LOST_LOGGER_DUE_TO_WEAK_REFERENCE") + @RequirePOST public HttpResponse doConfigLogger(@QueryParameter String name, @QueryParameter String level) { Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER); Level lv; diff --git a/core/src/main/java/hudson/model/MyViewsProperty.java b/core/src/main/java/hudson/model/MyViewsProperty.java index a7a40014e8..56c56f1d1a 100644 --- a/core/src/main/java/hudson/model/MyViewsProperty.java +++ b/core/src/main/java/hudson/model/MyViewsProperty.java @@ -52,6 +52,7 @@ import org.kohsuke.stapler.QueryParameter; import org.kohsuke.stapler.StaplerFallback; import org.kohsuke.stapler.StaplerRequest; import org.kohsuke.stapler.StaplerResponse; +import org.kohsuke.stapler.interceptor.RequirePOST; /** * A UserProperty that remembers user-private views. @@ -149,6 +150,7 @@ public class MyViewsProperty extends UserProperty implements ModifiableViewGroup return new HttpRedirect("view/" + Util.rawEncode(getPrimaryView().getViewName()) + "/"); } + @RequirePOST public synchronized void doCreateView(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException, ParseException, FormException { checkPermission(View.CREATE); diff --git a/core/src/main/java/hudson/model/TaskAction.java b/core/src/main/java/hudson/model/TaskAction.java index 3a7a657d7a..aa7183c371 100644 --- a/core/src/main/java/hudson/model/TaskAction.java +++ b/core/src/main/java/hudson/model/TaskAction.java @@ -35,6 +35,7 @@ import java.io.IOException; import hudson.security.Permission; import hudson.security.ACL; +import org.kohsuke.stapler.interceptor.RequirePOST; /** * Partial {@link Action} implementation for those who kick some @@ -137,6 +138,7 @@ public abstract class TaskAction extends AbstractModelObject implements Action { /** * Clears the error status. */ + @RequirePOST public synchronized void doClearError(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException { getACL().checkPermission(getPermission()); diff --git a/core/src/main/java/hudson/model/UpdateSite.java b/core/src/main/java/hudson/model/UpdateSite.java index 13a5957125..08ef75cc35 100644 --- a/core/src/main/java/hudson/model/UpdateSite.java +++ b/core/src/main/java/hudson/model/UpdateSite.java @@ -176,6 +176,7 @@ public class UpdateSite { /** * This is the endpoint that receives the update center data file from the browser. */ + @RequirePOST public FormValidation doPostBack(StaplerRequest req) throws IOException, GeneralSecurityException { DownloadSettings.checkPostBackAccess(); return updateData(IOUtils.toString(req.getInputStream(),"UTF-8"), true); diff --git a/core/src/main/java/hudson/slaves/AbstractCloudComputer.java b/core/src/main/java/hudson/slaves/AbstractCloudComputer.java index 32acc2030a..15a218d1c9 100644 --- a/core/src/main/java/hudson/slaves/AbstractCloudComputer.java +++ b/core/src/main/java/hudson/slaves/AbstractCloudComputer.java @@ -27,6 +27,7 @@ import hudson.model.Computer; import org.kohsuke.stapler.HttpRedirect; import org.kohsuke.stapler.HttpResponse; import org.kohsuke.stapler.HttpResponses; +import org.kohsuke.stapler.interceptor.RequirePOST; import java.io.IOException; import javax.annotation.CheckForNull; @@ -53,6 +54,7 @@ public class AbstractCloudComputer extends SlaveCo * When the slave is deleted, free the node right away. */ @Override + @RequirePOST public HttpResponse doDoDelete() throws IOException { checkPermission(DELETE); try { diff --git a/core/src/main/java/hudson/util/DoubleLaunchChecker.java b/core/src/main/java/hudson/util/DoubleLaunchChecker.java index 3404650233..cbe8857c53 100644 --- a/core/src/main/java/hudson/util/DoubleLaunchChecker.java +++ b/core/src/main/java/hudson/util/DoubleLaunchChecker.java @@ -31,6 +31,7 @@ import org.apache.commons.io.FileUtils; import org.codehaus.mojo.animal_sniffer.IgnoreJRERequirement; import org.kohsuke.stapler.StaplerRequest; import org.kohsuke.stapler.StaplerResponse; +import org.kohsuke.stapler.interceptor.RequirePOST; import javax.servlet.ServletException; import javax.servlet.ServletContext; @@ -175,6 +176,7 @@ public class DoubleLaunchChecker { /** * Ignore the problem and go back to using Hudson. */ + @RequirePOST public void doIgnore(StaplerRequest req, StaplerResponse rsp) throws IOException { ignore = true; Jenkins.getInstance().servletContext.setAttribute("app", Jenkins.getInstance()); diff --git a/core/src/main/java/jenkins/diagnosis/HsErrPidFile.java b/core/src/main/java/jenkins/diagnosis/HsErrPidFile.java index 39d5425aac..8d86a6b13c 100644 --- a/core/src/main/java/jenkins/diagnosis/HsErrPidFile.java +++ b/core/src/main/java/jenkins/diagnosis/HsErrPidFile.java @@ -4,6 +4,7 @@ import hudson.Util; import hudson.util.HttpResponses; import jenkins.model.Jenkins; import org.kohsuke.stapler.HttpResponse; +import org.kohsuke.stapler.interceptor.RequirePOST; import java.io.File; import java.io.IOException; @@ -48,6 +49,7 @@ public class HsErrPidFile { return HttpResponses.staticResource(file); } + @RequirePOST public HttpResponse doDelete() throws IOException { Jenkins.getInstance().checkPermission(Jenkins.ADMINISTER); file.delete(); diff --git a/core/src/main/resources/hudson/util/DoubleLaunchChecker/index.jelly b/core/src/main/resources/hudson/util/DoubleLaunchChecker/index.jelly index d126380218..cfbbda0abd 100644 --- a/core/src/main/resources/hudson/util/DoubleLaunchChecker/index.jelly +++ b/core/src/main/resources/hudson/util/DoubleLaunchChecker/index.jelly @@ -45,7 +45,7 @@ THE SOFTWARE.
-
+
From 1f672323925dda7e427559dd68e9a7207d47ea90 Mon Sep 17 00:00:00 2001 From: Daniel Beck Date: Fri, 14 Apr 2017 20:02:55 +0200 Subject: [PATCH 3/4] [SECURITY-420] RequirePOST for proxy validation --- core/src/main/java/hudson/ProxyConfiguration.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/core/src/main/java/hudson/ProxyConfiguration.java b/core/src/main/java/hudson/ProxyConfiguration.java index 9b51990925..e5c14b82b9 100644 --- a/core/src/main/java/hudson/ProxyConfiguration.java +++ b/core/src/main/java/hudson/ProxyConfiguration.java @@ -56,6 +56,7 @@ import org.apache.commons.httpclient.methods.GetMethod; import org.jvnet.robust_http_client.RetryableHttpStream; import org.kohsuke.stapler.DataBoundConstructor; import org.kohsuke.stapler.QueryParameter; +import org.kohsuke.stapler.interceptor.RequirePOST; /** * HTTP proxy configuration. @@ -296,6 +297,7 @@ public final class ProxyConfiguration extends AbstractDescribableImpl Date: Fri, 14 Apr 2017 20:34:48 +0200 Subject: [PATCH 4/4] [SECURITY-420] Adapt form --- core/src/main/resources/hudson/model/TaskAction/log.jelly | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/src/main/resources/hudson/model/TaskAction/log.jelly b/core/src/main/resources/hudson/model/TaskAction/log.jelly index 388f4d6393..f7be5cfb7a 100644 --- a/core/src/main/resources/hudson/model/TaskAction/log.jelly +++ b/core/src/main/resources/hudson/model/TaskAction/log.jelly @@ -42,7 +42,7 @@ THE SOFTWARE. ${it.obtainLog().writeLogTo(0,output)} -
+