OpenSource/jenkins
1
0 Fork 0
mirror of https://github.com/jenkinsci/jenkins.git synced 2026-11-03 15:15:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'security-stable-2.73' into security-stable-2.89

Browse Source
This commit is contained in:
Jesse Glick committed 2018-02-08 15:41:25 +01:00
2 parents 65f66f99d9 d5fda65e3f
commit d69cf66948
2 files changed
+5 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

core/src/main/java/hudson/Plugin.java
+3 -1
View File
@@ -44,6 +44,7 @@ import com.thoughtworks.xstream.XStream;
import hudson.init.Initializer;
import hudson.init.Terminator;
import java.net.URL;
import java.util.Locale;
import java.util.logging.Logger;
import jenkins.model.GlobalConfiguration;
@@ -226,7 +227,8 @@ public abstract class Plugin implements Saveable {
public void doDynamic(StaplerRequest req, StaplerResponse rsp) throws IOException, ServletException {
String path = req.getRestOfPath();
if (path.isEmpty() || path.contains("..") || path.contains("%") || path.contains("META-INF") || path.contains("WEB-INF")) {
String pathUC = path.toUpperCase(Locale.ENGLISH);
if (path.isEmpty() || path.contains("..") || path.contains("%") || pathUC.contains("META-INF") || pathUC.contains("WEB-INF")) {
LOGGER.warning("rejecting possibly malicious " + req.getRequestURIWithQueryString());
rsp.sendError(HttpServletResponse.SC_BAD_REQUEST);
return;