As much as we'd like to enable this by default, what we've learned over
the past few days indicate that this is just too disruptive a change. In a nutshell,
- The change is just too big. It touches more than 4000 lines just in the core and remoting,
which makes this by far the biggest change we've done in secret. The chance of something
going wrong is just too high. As recently as yesterday we are still finding significant
problems with this subsystem.
- We've learnt that Subversion 1.x contains Callables that we cannot just whitelist, but
that version is used by roughly a third of users. If we put this on by default, they will
see their builds break.
- Every time we come up with a new way to scan plugins to find impacted code, we always
find several plugins that are affected, indicating that we probably have missed more
plugins that will be impacted.
- We haven't really analyzed past versions of any plugins at all, but as the Subversion
version distribution indicates, considerable portion of people run old plugins.
As we see in the Wiki page (http://jenkins-ci.org/security-144), vast majority of Jenkins
installations will fit in the category of "I have set up Jenkins master and all slaves by
myself", for whom this subsystem is entirely redundant.
Based on the knowledge we now have about the impact of this addition, and considering people
who benefit from this vs people who don't benefit from this, I'm not enabling this feature
out of the box, just yet.
Our plan is to advertise this feature, then get necesary plugin updates in place over time.
At some later point, we can make this feature on by default, which will only impact new
installations. Further down the road, we can inch up the warning given to people who run
without this feature, or remove the GUI configuration and force this feature on, to get
close to the ideal state of having everyone run with this feature on.
Jesse doesn't like this, but I think he understands where I'm coming from. Sorry Jesse,
this time I'm having this my way.
- Added <JOBDIR> based on Daniel's comment
- Path macros need to be translated if on Windows
- Windows treat '/' as a valid path separator, so it needs to be normalized to '\\'.
Daniel Beck pointed out that if we ask people to create files not writable from Jenkins as a means to suppress edit to gui.conf,
then we should just stick to the same approach all the way.
This code duplication in two sides of the if statement is undesirable.
Post-release, I need to come back here to introduce a variant of FileCallable that runs on the given FilePath but with InputStream to another FilePath.
Kohsuke Kawaguchi