From 8830d68f5fe21f344be3496984bc4470bfcd0564 Mon Sep 17 00:00:00 2001 From: Jesse Glick Date: Thu, 8 Feb 2018 15:37:47 +0100 Subject: [PATCH] [SECURITY-717] Plugin.doDynamic check for WEB-INF or META-INF should be case-insensitive. --- core/src/main/java/hudson/Plugin.java | 4 +++- test/src/test/java/hudson/PluginTest.java | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/hudson/Plugin.java b/core/src/main/java/hudson/Plugin.java index b955a6d3ad..e8d8be1e69 100644 --- a/core/src/main/java/hudson/Plugin.java +++ b/core/src/main/java/hudson/Plugin.java @@ -44,6 +44,7 @@ import com.thoughtworks.xstream.XStream; import hudson.init.Initializer; import hudson.init.Terminator; import java.net.URL; +import java.util.Locale; import java.util.logging.Logger; import jenkins.model.GlobalConfiguration; @@ -226,7 +227,8 @@ public abstract class Plugin implements Saveable { public void doDynamic(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException { String path = req.getRestOfPath(); - if (path.isEmpty() || path.contains("..") || path.contains("%") || path.contains("META-INF") || path.contains("WEB-INF")) { + String pathUC = path.toUpperCase(Locale.ENGLISH); + if (path.isEmpty() || path.contains("..") || path.contains("%") || pathUC.contains("META-INF") || pathUC.contains("WEB-INF")) { LOGGER.warning("rejecting possibly malicious " + req.getRequestURIWithQueryString()); rsp.sendError(HttpServletResponse.SC_BAD_REQUEST); return; diff --git a/test/src/test/java/hudson/PluginTest.java b/test/src/test/java/hudson/PluginTest.java index dd7026406b..4ddfd44f94 100644 --- a/test/src/test/java/hudson/PluginTest.java +++ b/test/src/test/java/hudson/PluginTest.java @@ -51,6 +51,8 @@ public class PluginTest { // SECURITY-155: r.createWebClient().assertFails("plugin/credentials/WEB-INF/licenses.xml", HttpServletResponse.SC_BAD_REQUEST); r.createWebClient().assertFails("plugin/credentials/META-INF/MANIFEST.MF", HttpServletResponse.SC_BAD_REQUEST); + r.createWebClient().assertFails("plugin/credentials/web-inf/licenses.xml", HttpServletResponse.SC_BAD_REQUEST); + r.createWebClient().assertFails("plugin/credentials/meta-inf/manifest.mf", HttpServletResponse.SC_BAD_REQUEST); } }