Merge pull request #3187 from daniel-beck/JENKINS-34254-v2

[JENKINS-34254] Fix RequirePOST form

(cherry picked from commit 76c9f8beac)

core/pom.xml

@@ -39,7 +39,7 @@ THE SOFTWARE.
 
   <properties>
     <staplerFork>true</staplerFork>
-    <stapler.version>1.253</stapler.version>
+    <stapler.version>1.254</stapler.version>
     <spring.version>2.5.6.SEC03</spring.version>
     <groovy.version>2.4.11</groovy.version>
     <!-- TODO: Actually many issues are being filtered by src/findbugs/findbugs-excludes.xml -->

core/src/main/java/hudson/security/csrf/CrumbFilter.java

@@ -8,6 +8,11 @@ package hudson.security.csrf;
 import hudson.util.MultipartFormDataParser;
 import jenkins.model.Jenkins;
 import org.acegisecurity.providers.anonymous.AnonymousAuthenticationToken;
+import org.kohsuke.MetaInfServices;
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
+import org.kohsuke.stapler.ForwardToView;
+import org.kohsuke.stapler.interceptor.RequirePOST;
 
 import java.io.IOException;
 import java.util.Enumeration;
@@ -41,6 +46,15 @@ public class CrumbFilter implements Filter {
         return h.getCrumbIssuer();
     }
 
+    @Restricted(NoExternalUse.class)
+    @MetaInfServices
+    public static class ErrorCustomizer implements RequirePOST.ErrorCustomizer {
+        @Override
+        public ForwardToView getForwardView() {
+            return new ForwardToView(CrumbFilter.class, "retry");
+        }
+    }
+
     public void init(FilterConfig filterConfig) throws ServletException {
     }
 

core/src/main/resources/hudson/security/csrf/CrumbFilter/retry.jelly

@@ -0,0 +1,42 @@
+<!--
+The MIT License
+
+Copyright (c) 2017, Daniel Beck
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
+    <st:statusCode value="405"/>
+    <l:layout norefresh="true" title="${%Method Not Allowed}">
+
+        <l:main-panel>
+            <h1>${%This URL requires POST}</h1>
+            <p>
+                ${%blurb}
+            </p>
+            <p><tt>${requestURL}</tt></p>
+            <p><strong>${%warning}</strong></p>
+            <f:form method="post" name="retry">
+                <f:submit value="${%Retry using POST}"/>
+            </f:form>
+        </l:main-panel>
+    </l:layout>
+</j:jelly>

core/src/main/resources/hudson/security/csrf/CrumbFilter/retry.properties

@@ -0,0 +1,4 @@
+blurb = The URL you're trying to access requires that requests be sent using POST (like a form submission). \
+  The button below allows you to retry accessing this URL using POST. \
+  URL being accessed:
+warning = If you were sent here from an untrusted source, please proceed with caution.

test/src/test/java/hudson/security/csrf/DefaultCrumbIssuerTest.java

@@ -8,6 +8,8 @@ package hudson.security.csrf;
 
 import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
 import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import jenkins.model.Jenkins;
+import junit.framework.Assert;
 import net.sf.json.JSONObject;
 import org.junit.Before;
 import org.junit.Rule;
@@ -135,4 +137,19 @@ public class DefaultCrumbIssuerTest {
         wc.assertFails("crumbIssuer/api/json?jsonp=hack", HttpURLConnection.HTTP_FORBIDDEN);
     }
 
+    @Issue("JENKINS-34254")
+    @Test public void testRequirePostErrorPageCrumb() throws Exception {
+        Jenkins.getInstance().setCrumbIssuer(new DefaultCrumbIssuer(false));
+        WebClient wc = r.createWebClient();
+        try {
+            wc.goTo("quietDown");
+            fail("expected failure");
+        } catch (FailingHttpStatusCodeException ex) {
+            Assert.assertEquals("expect HTTP 405 method not allowed", 405, ex.getStatusCode());
+        }
+        HtmlPage retry = (HtmlPage) wc.getCurrentWindow().getEnclosedPage();
+        HtmlPage success = r.submit(retry.getFormByName("retry"));
+        Assert.assertTrue("quieting down", r.jenkins.isQuietingDown());
+    }
+
 }