[JENKINS-70906] Remove prototype from core

core/src/main/java/jenkins/model/experimentalflags/RemovePrototypeUserExperimentalFlag.java

@@ -38,7 +38,7 @@ public RemovePrototypeUserExperimentalFlag() {
     @NonNull
     @Override
     public Boolean getDefaultValue() {
-        return false;
+        return true;
     }
 
     @Override

core/src/main/resources/hudson/tools/AbstractCommandInstaller/config.jelly

@@ -24,7 +24,7 @@ THE SOFTWARE.
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:f="/lib/form" xmlns:st="jelly:stapler" xmlns:t="/hudson/tools">
     <f:entry title="${%Command}" field="command">
-        <f:textarea checkMethod="post"/>
+        <f:textarea />
     </f:entry>
     <f:entry title="${%Tool Home}" field="toolHome">
         <f:textbox/>

core/src/main/resources/hudson/tools/ZipExtractionInstaller/config.jelly

@@ -24,7 +24,7 @@ THE SOFTWARE.
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:f="/lib/form" xmlns:st="jelly:stapler" xmlns:t="/hudson/tools">
     <f:entry title="${%Download URL for binary archive}" field="url">
-        <f:textbox checkMethod="post"/>
+        <f:textbox />
     </f:entry>
     <f:entry title="${%Subdirectory of extracted archive}" field="subdir">
         <f:textbox/>

core/src/main/resources/jenkins/security/ResourceDomainConfiguration/config.jelly

@@ -26,7 +26,7 @@ THE SOFTWARE.
 <j:jelly xmlns:j="jelly:core" xmlns:f="/lib/form">
     <f:section title="${%Serve resource files from another domain}">
         <f:entry title="${%Resource Root URL}" field="url">
-            <f:textbox checkMethod="post"/>
+            <f:textbox />
         </f:entry>
     </f:section>
 </j:jelly>

core/src/main/resources/lib/form/combobox.jelly

@@ -62,11 +62,6 @@ THE SOFTWARE.
       If @field is specified, this will be inferred automatically,
       which is the recommended approach.
     </st:attribute>
-    <st:attribute name="checkMethod" use="optional" type="String">
-      Specify 'get' (must be lowercase) to change the HTTP method used for the AJAX requests to @checkUrl from a POST to a GET.
-      If any other value is specified then requests will use POST.
-      The historical default was GET and 'post' had to be specified to change that, but this was changed in Jenkins 2.285.
-    </st:attribute>
   </st:documentation>
   <f:prepareDatabinding/>
   ${descriptor.calcFillSettings(field,attrs)} <!-- this figures out the 'fillUrl' and 'fillDependsOn' attribute -->

core/src/main/resources/lib/form/number.jelly

@@ -80,11 +80,6 @@ THE SOFTWARE.
       If @field is specified, this will be inferred automatically,
       which is the recommended approach.
     </st:attribute>
-    <st:attribute name="checkMethod" use="optional" type="String">
-      Specify 'get' (must be lowercase) to change the HTTP method used for the AJAX requests to @checkUrl from a POST to a GET.
-      If any other value is specified then requests will use POST.
-      The historical default was GET and 'post' had to be specified to change that, but this was changed in Jenkins 2.285.
-    </st:attribute>
   </st:documentation>
   <f:prepareDatabinding />
 

core/src/main/resources/lib/form/password.jelly

@@ -83,7 +83,6 @@ THE SOFTWARE.
                          name="${attrs.name ?: '_.'+attrs.field}"
                          value="${value}"
                          type="hidden"
-                         checkMethod="post"
                          ATTRIBUTES="${attrs}" EXCEPT="field clazz value"/>
                 <div class="hidden-password-placeholder">
                   <div class="hidden-password-legend">
@@ -103,7 +102,6 @@ THE SOFTWARE.
                        value="${value}"
                        type="text"
                        oninput="this.setAttribute('type', 'password'); return true;"
-                       checkMethod="post"
                        ATTRIBUTES="${attrs}" EXCEPT="field clazz value"/>
               <!-- TODO consider customizedFields -->
             </j:otherwise>
@@ -115,7 +113,6 @@ THE SOFTWARE.
                    name="${attrs.name ?: '_.'+attrs.field}"
                    value="${h.getPasswordValue(resolvedValue)}"
                    type="password"
-                   checkMethod="post"
                    ATTRIBUTES="${attrs}" EXCEPT="field clazz value"/>
         </j:otherwise>
       </j:choose>

core/src/main/resources/lib/form/readOnlyTextbox.jelly

@@ -70,7 +70,7 @@ THE SOFTWARE.
          id="${attrs.id}"
          type="text"
          readonly="readonly"
-         checkUrl="${attrs.checkUrl}" checkDependsOn="${attrs.checkDependsOn}" checkMethod="${attrs.checkMethod}"
+         checkUrl="${attrs.checkUrl}" checkDependsOn="${attrs.checkDependsOn}"
          checkMessage="${attrs.checkMessage}"
          onchange="${attrs.onchange}" onkeyup="${attrs.onkeyup}"/>
 </j:jelly>

core/src/main/resources/lib/form/repeatable/repeatable.js

@@ -24,7 +24,7 @@ var repeatableSupport = {
     master.parentNode.removeChild(master);
     this.insertionPoint = insertionPoint;
     this.name = master.getAttribute("name");
-    if (this.container.getAttribute("enableTopButton") == "true") {
+    if (this.container.getAttribute("enableTopButton") === "true") {
       this.enableTopButton = true;
     } else {
       this.enableTopButton = false;
@@ -44,7 +44,7 @@ var repeatableSupport = {
     // nc = document.importNode(node,true);
     var nc = document.createElement("div");
     nc.className = "repeated-chunk";
-    nc.style.opacity = 0;
+    nc.style.opacity = "0";
     nc.setAttribute("name", this.name);
     nc.innerHTML = this.blockHTML;
     if (!addOnTop) {
@@ -79,27 +79,27 @@ var repeatableSupport = {
       return n.classList.contains("repeated-chunk");
     });
 
-    if (children.length == 0) {
+    if (children.length === 0) {
       var addButtonElements = Array.from(this.container.children).filter(
         function (b) {
           return b.classList.contains("repeatable-add");
         }
       );
 
-      if (addButtonElements.length == 2) {
+      if (addButtonElements.length === 2) {
         var buttonElement = addButtonElements[0];
         var parentOfButton = buttonElement.parentNode;
         parentOfButton.removeChild(buttonElement);
       }
     } else {
-      if (children.length == 1) {
+      if (children.length === 1) {
         addButtonElements = Array.from(this.container.children).filter(
           function (b) {
             return b.classList.contains("repeatable-add");
           }
         );
 
-        if (addButtonElements.length == 1 && this.enableTopButton) {
+        if (addButtonElements.length === 1 && this.enableTopButton) {
           buttonElement = addButtonElements[0];
           parentOfButton = buttonElement.parentNode;
           var addTopButton = document.createElement("input");
@@ -160,7 +160,7 @@ var repeatableSupport = {
     var inputs = n.getElementsByTagName("INPUT");
     for (var i = 0; i < inputs.length; i++) {
       var input = inputs[i];
-      if (input.name == "hudson-tools-InstallSourceProperty") {
+      if (input.name === "hudson-tools-InstallSourceProperty") {
         updateOptionalBlock(input);
       }
     }
@@ -237,7 +237,7 @@ Behaviour.specify(
 Behaviour.specify("DIV.repeated-chunk", "repeatable", -200, function (d) {
   var inputs = d.getElementsByTagName("INPUT");
   for (var i = 0; i < inputs.length; i++) {
-    if (inputs[i].type == "radio") {
+    if (inputs[i].type === "radio") {
       // Need to uniquify each set of radio buttons in repeatable content.
       // buildFormTree will remove the prefix before form submission.
       var prefix = d.getAttribute("radioPrefix");

core/src/main/resources/lib/form/select.jelly

@@ -51,11 +51,6 @@ THE SOFTWARE.
       If @field is specified, this will be inferred automatically,
       which is the recommended approach.
     </st:attribute>
-    <st:attribute name="checkMethod" use="optional" type="String">
-      Specify 'get' (must be lowercase) to change the HTTP method used for the AJAX requests to @checkUrl from a POST to a GET.
-      If any other value is specified then requests will use POST.
-      The historical default was GET and 'post' had to be specified to change that, but this was changed in Jenkins 2.285.
-    </st:attribute>
   </st:documentation>
 
   <f:prepareDatabinding/>

core/src/main/resources/lib/form/textarea.jelly

@@ -57,11 +57,6 @@ THE SOFTWARE.
       If @field is specified, this will be inferred automatically,
       which is the recommended approach.
     </st:attribute>
-    <st:attribute name="checkMethod" use="optional" type="String">
-      Specify 'get' (must be lowercase) to change the HTTP method used for the AJAX requests to @checkUrl from a POST to a GET.
-      If any other value is specified then requests will use POST.
-      The historical default was GET and 'post' had to be specified to change that, but this was changed in Jenkins 2.285.
-    </st:attribute>
     <st:attribute name="codemirror-mode">
       Turns this text area into CodeMirror-assisted code editing text area.
       This attribute specifies the mode of CodeMirror, such as "text/x-java".
@@ -93,7 +88,7 @@ THE SOFTWARE.
       <textarea id="${attrs.id}" style="${attrs.style}"
                 name ="${name}"
                 class="jenkins-input ${attrs.checkUrl!=null?'validated':''} ${attrs['codemirror-mode']!=null?'codemirror':''} ${attrs.class}"
-                checkUrl="${attrs.checkUrl}" checkDependsOn="${attrs.checkDependsOn}" checkMethod="${attrs.checkMethod}"
+                checkUrl="${attrs.checkUrl}" checkDependsOn="${attrs.checkDependsOn}"
                 rows="${h.determineRows(value)}"
                 readonly="${attrs.readonly}"
                 codemirror-mode="${attrs['codemirror-mode']}"

core/src/main/resources/lib/form/textbox.jelly

@@ -77,11 +77,6 @@ THE SOFTWARE.
       If @field is specified, this will be inferred automatically,
       which is the recommended approach.
     </st:attribute>
-    <st:attribute name="checkMethod" use="optional" type="String">
-      Specify 'get' (must be lowercase) to change the HTTP method used for the AJAX requests to @checkUrl from a POST to a GET.
-      If any other value is specified then requests will use POST.
-      The historical default was GET and 'post' had to be specified to change that, but this was changed in Jenkins 2.285.
-    </st:attribute>
     <st:attribute name="autoCompleteUrl">
       Url to use for auto-completion
 

test/src/test/java/hudson/tools/ZipExtractionInstallerTest.java

@@ -24,33 +24,16 @@
 
 package hudson.tools;
 
-import static org.hamcrest.MatcherAssert.assertThat;
-import static org.hamcrest.Matchers.containsString;
 import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.fail;
 
 import com.gargoylesoftware.htmlunit.HttpMethod;
 import com.gargoylesoftware.htmlunit.WebRequest;
-import com.gargoylesoftware.htmlunit.html.HtmlPage;
-import com.gargoylesoftware.htmlunit.html.HtmlTextInput;
-import com.gargoylesoftware.htmlunit.javascript.JavaScriptEngine;
-import com.gargoylesoftware.htmlunit.javascript.host.xml.XMLHttpRequest;
-import edu.umd.cs.findbugs.annotations.NonNull;
-import edu.umd.cs.findbugs.annotations.Nullable;
-import hudson.model.JDK;
 import hudson.model.User;
-import hudson.util.FormValidation;
-import java.lang.reflect.Field;
 import java.net.HttpURLConnection;
 import java.net.URL;
-import java.net.URLDecoder;
 import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
-import java.util.ArrayList;
-import java.util.List;
 import jenkins.model.Jenkins;
-import net.sourceforge.htmlunit.corejs.javascript.Function;
-import net.sourceforge.htmlunit.corejs.javascript.Scriptable;
 import org.junit.Rule;
 import org.junit.Test;
 import org.junit.rules.TemporaryFolder;
@@ -94,89 +77,4 @@ public void onlyAdminCanReachTheDoCheck() throws Exception {
         userWc.login(USER);
         assertEquals(HttpURLConnection.HTTP_FORBIDDEN, userWc.getPage(request).getWebResponse().getStatusCode());
     }
-
-    @Test
-    @Issue("SECURITY-794")
-    public void roundtrip() throws Exception {
-        final String VALID_URL = "https://www.google.com";
-        final String INVALID_URL = "only-crappy-letters";
-
-        ZipExtractionInstaller installer = new ZipExtractionInstaller("", VALID_URL, "");
-
-        j.jenkins.getJDKs().add(new JDK("test", tmp.getRoot().getAbsolutePath(), List.of(
-                new InstallSourceProperty(List.of(installer)))));
-
-        JenkinsRule.WebClient wc = j.createWebClient();
-
-        SpyingJavaScriptEngine jsEngine = new SpyingJavaScriptEngine(wc, "ZipExtractionInstaller/checkUrl", HttpMethod.POST);
-        wc.setJavaScriptEngine(jsEngine);
-
-        HtmlPage page = wc.goTo("configureTools");
-
-        XMLHttpRequest lastRequest = jsEngine.getLastRequest();
-        String body = URLDecoder.decode(getPrivateWebRequestField(lastRequest).getRequestBody(), StandardCharsets.UTF_8);
-        assertThat(body, containsString(VALID_URL));
-        assertEquals(FormValidation.ok().renderHtml(), lastRequest.getResponseText());
-
-        HtmlTextInput urlInput = page.getDocumentElement().getOneHtmlElementByAttribute("input", "value", VALID_URL);
-        urlInput.setAttribute("value", INVALID_URL);
-        j.submit(page.getFormByName("config"));
-
-        JDK jdk = j.jenkins.getJDK("test");
-        InstallSourceProperty isp = jdk.getProperties().get(InstallSourceProperty.class);
-        assertEquals(1, isp.installers.size());
-        assertEquals(INVALID_URL, isp.installers.get(ZipExtractionInstaller.class).getUrl());
-
-        wc.goTo("configureTools");
-
-        lastRequest = jsEngine.getLastRequest();
-        body = URLDecoder.decode(getPrivateWebRequestField(lastRequest).getRequestBody(), StandardCharsets.UTF_8);
-        assertThat(body, containsString(INVALID_URL));
-        assertThat(lastRequest.getResponseText(), containsString(Messages.ZipExtractionInstaller_malformed_url()));
-    }
-
-    private static class SpyingJavaScriptEngine extends JavaScriptEngine {
-        private List<XMLHttpRequest> storedRequests = new ArrayList<>();
-        private String urlToMatch;
-        private HttpMethod method;
-
-        SpyingJavaScriptEngine(JenkinsRule.WebClient wc, @Nullable String urlToMatch, @Nullable HttpMethod method) {
-            super(wc);
-            this.urlToMatch = urlToMatch;
-            this.method = method;
-        }
-
-        @Override
-        public Object callFunction(HtmlPage page, Function function, Scriptable scope, Scriptable thisObject, Object[] args) {
-            if (thisObject instanceof XMLHttpRequest) {
-                try {
-                    WebRequest request = getPrivateWebRequestField((XMLHttpRequest) thisObject);
-                    boolean correctUrl = urlToMatch == null || request.getUrl().toString().contains(urlToMatch);
-                    boolean correctMethod = method == null || request.getHttpMethod().equals(method);
-                    if (correctUrl && correctMethod) {
-                        if (((XMLHttpRequest) thisObject).getReadyState() == 4) {
-                            storedRequests.add((XMLHttpRequest) thisObject);
-                        }
-                    }
-                } catch (NoSuchFieldException | IllegalAccessException e) {
-                    throw new LinkageError(e.getMessage(), e);
-                }
-            }
-            return super.callFunction(page, function, scope, thisObject, args);
-        }
-
-        @NonNull
-        public XMLHttpRequest getLastRequest() {
-            if (storedRequests.isEmpty()) {
-                fail("There is no available requests for the proposed url/method");
-            }
-            return storedRequests.get(storedRequests.size() - 1);
-        }
-    }
-
-    private static WebRequest getPrivateWebRequestField(XMLHttpRequest xmlHttpRequest) throws NoSuchFieldException, IllegalAccessException {
-        Field webRequest_Field = XMLHttpRequest.class.getDeclaredField("webRequest_");
-        webRequest_Field.setAccessible(true);
-        return (WebRequest) webRequest_Field.get(xmlHttpRequest);
-    }
 }

test/src/test/java/scripts/BehaviorTest.java

@@ -50,16 +50,16 @@ public void testCssSelectors() throws Exception {
         HtmlPage p = j.createWebClient().goTo("self/testCssSelectors");
 
         // basic class selector, that we use the most often
-        assertEquals(2, asInt(p.executeJavaScript("findElementsBySelector($('test1'),'.a',true).length")));
-        assertEquals(1, asInt(p.executeJavaScript("findElementsBySelector($('test1'),'.a',false).length")));
+        assertEquals(2, asInt(p.executeJavaScript("findElementsBySelector(document.querySelector('#test1'),'.a',true).length")));
+        assertEquals(1, asInt(p.executeJavaScript("findElementsBySelector(document.querySelector('#test1'),'.a',false).length")));
 
         // 'includeSelf' should only affect the first axis and not afterward
-        assertEquals(1, asInt(p.executeJavaScript("findElementsBySelector($('test2'),'.a .b',true).length")));
-        assertEquals(1, asInt(p.executeJavaScript("findElementsBySelector($('test2'),'.a .b',false).length")));
+        assertEquals(1, asInt(p.executeJavaScript("findElementsBySelector(document.querySelector('#test2'),'.a .b',true).length")));
+        assertEquals(1, asInt(p.executeJavaScript("findElementsBySelector(document.querySelector('#test2'),'.a .b',false).length")));
 
         // tag.class. Should exclude itself anyway even if it's included
-        assertEquals(1, asInt(p.executeJavaScript("findElementsBySelector($('test3'),'P.a',true).length")));
-        assertEquals(1, asInt(p.executeJavaScript("findElementsBySelector($('test3'),'P.a',false).length")));
+        assertEquals(1, asInt(p.executeJavaScript("findElementsBySelector(document.querySelector('#test3'),'P.a',true).length")));
+        assertEquals(1, asInt(p.executeJavaScript("findElementsBySelector(document.querySelector('#test3'),'P.a',false).length")));
     }
 
     private int asInt(ScriptResult r) {