OpenSource/jenkins
1
0 Fork 0
mirror of https://github.com/jenkinsci/jenkins.git synced 2026-11-13 20:12:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

[SECURITY-2823]

Browse Source
This commit is contained in:
Kevin-CB authored and Jenkins CERT CI committed 2023-02-23 07:58:53 +00:00
1 parent 40663588ee
commit f39c11fa27
2 files changed
+77 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

core/src/main/java/hudson/PluginManager.java
+20 -1
View File
@@ -28,6 +28,8 @@ import static hudson.init.InitMilestone.COMPLETED;
import static hudson.init.InitMilestone.PLUGINS_LISTED;
import static hudson.init.InitMilestone.PLUGINS_PREPARED;
import static hudson.init.InitMilestone.PLUGINS_STARTED;
import static java.nio.file.attribute.PosixFilePermission.OWNER_READ;
import static java.nio.file.attribute.PosixFilePermission.OWNER_WRITE;
import static java.util.logging.Level.FINE;
import static java.util.logging.Level.INFO;
import static java.util.logging.Level.WARNING;
@@ -81,6 +83,7 @@ import java.net.URLClassLoader;
import java.net.URLConnection;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.nio.file.FileSystems;
import java.nio.file.Files;
import java.nio.file.InvalidPathException;
import java.nio.file.Paths;
@@ -88,8 +91,10 @@ import java.nio.file.attribute.FileTime;
import java.security.CodeSource;
import java.time.Duration;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.EnumSet;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.HashSet;
@@ -1860,7 +1865,8 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
String fileName = "";
PluginCopier copier;
ServletFileUpload upload = new ServletFileUpload(new DiskFileItemFactory());
File tmpDir = Files.createTempDirectory("uploadDir").toFile();
ServletFileUpload upload = new ServletFileUpload(new DiskFileItemFactory(DiskFileItemFactory.DEFAULT_SIZE_THRESHOLD, tmpDir));
List<FileItem> items = upload.parseRequest(req);
if (StringUtils.isNotBlank(items.get(1).getString())) {
// this is a URL deployment
@@ -1873,6 +1879,16 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
copier = new FileUploadPluginCopier(fileItem);
}
if (FileSystems.getDefault().supportedFileAttributeViews().contains("posix")) {
Arrays.stream(Objects.requireNonNull(tmpDir.listFiles())).forEach((file -> {
try {
Files.setPosixFilePermissions(file.toPath(), EnumSet.of(OWNER_READ, OWNER_WRITE));
} catch (IOException e) {
throw new RuntimeException(e);
}
}));
}
if ("".equals(fileName)) {
return new HttpRedirect("advanced");
}
@@ -1893,6 +1909,9 @@ public abstract class PluginManager extends AbstractModelObject implements OnMas
throw new ServletException(e);
}
copier.cleanup();
if (!tmpDir.delete()) {
System.err.println("Failed to delete temporary directory: " + tmpDir);
}
final String baseName = identifyPluginShortName(t);