OpenSource/jenkins
1
0 Fork 0
mirror of https://github.com/jenkinsci/jenkins.git synced 2026-11-03 15:15:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SECURITY-717] Plugin.doDynamic check for WEB-INF or META-INF should be case-insensitive.

Browse Source
This commit is contained in:
Jesse Glick committed 2018-02-08 15:37:47 +01:00
1 parent 38249b561b
commit 8830d68f5f
2 files changed
+5 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

core/src/main/java/hudson/Plugin.java
+3 -1
View File
@@ -44,6 +44,7 @@ import com.thoughtworks.xstream.XStream;
import hudson.init.Initializer;
import hudson.init.Terminator;
import java.net.URL;
import java.util.Locale;
import java.util.logging.Logger;
import jenkins.model.GlobalConfiguration;
@@ -226,7 +227,8 @@ public abstract class Plugin implements Saveable {
public void doDynamic(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
String path = req.getRestOfPath();
if (path.isEmpty() || path.contains("..") || path.contains("%") || path.contains("META-INF") || path.contains("WEB-INF")) {
String pathUC = path.toUpperCase(Locale.ENGLISH);
if (path.isEmpty() || path.contains("..") || path.contains("%") || pathUC.contains("META-INF") || pathUC.contains("WEB-INF")) {
LOGGER.warning("rejecting possibly malicious " + req.getRequestURIWithQueryString());
rsp.sendError(HttpServletResponse.SC_BAD_REQUEST);
return;