[SECURITY-2023]

core/src/main/java/hudson/model/FingerprintMap.java

@@ -82,15 +82,8 @@ public final class FingerprintMap extends KeyedDataStorage<Fingerprint,Fingerpri
         return super.get(md5sum,createIfNotExist,createParams);
     }
 
-    private byte[] toByteArray(String md5sum) {
-        byte[] data = new byte[16];
-        for( int i=0; i<md5sum.length(); i+=2 )
-            data[i/2] = (byte)Integer.parseInt(md5sum.substring(i,i+2),16);
-        return data;
-    }
-
     protected @NonNull Fingerprint create(@NonNull String md5sum, @NonNull FingerprintParams createParams) throws IOException {
-        return new Fingerprint(createParams.build, createParams.fileName, toByteArray(md5sum));
+        return new Fingerprint(createParams.build, createParams.fileName, Util.fromHexString(md5sum));
     }
 
     protected @CheckForNull Fingerprint load(@NonNull String key) throws IOException {

core/src/main/java/jenkins/fingerprints/FileFingerprintStorage.java

@@ -75,6 +75,9 @@ public class FileFingerprintStorage extends FingerprintStorage {
      * Load the Fingerprint with the given unique id.
      */
     public @CheckForNull Fingerprint load(@NonNull String id) throws IOException {
+        if (!isAllowed(id)) {
+            return null;
+        }
         return load(getFingerprintFile(id));
     }
 
@@ -287,6 +290,15 @@ public class FileFingerprintStorage extends FingerprintStorage {
                 "fingerprints/" + id.substring(0,2) + '/' + id.substring(2,4) + '/' + id.substring(4) + ".xml");
     }
 
+    private static boolean isAllowed(String id) {
+        try {
+            Util.fromHexString(id);
+            return true;
+        } catch (NumberFormatException nfe) {
+            return false;
+        }
+    }
+
     private static String messageOfParseException(Throwable throwable) {
         if (throwable instanceof XmlPullParserException || throwable instanceof EOFException) {
             return throwable.getMessage();