Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[JENKINS-73422] Add escape hatch for Authenticated user access to Resource URL #9644

Merged
merged 2 commits into from
Aug 30, 2024
Merged

[JENKINS-73422] Add escape hatch for Authenticated user access to Resource URL #9644

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3aafb49
[JENKINS-73422] Add escape hatch for Authenticated user access to Res…
Dohbedoh Aug 22, 2024
875db38
[JENKINS-73422] Improve comment wording per review
Dohbedoh Aug 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion core/src/main/java/jenkins/security/ResourceDomainRootAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@ public Object getDynamic(String id, StaplerRequest req, StaplerResponse rsp) thr
return null;
}

if (!ACL.isAnonymous2(Jenkins.getAuthentication2())) {
if (!ALLOW_AUTHENTICATED_USER && !ACL.isAnonymous2(Jenkins.getAuthentication2())) {
rsp.sendError(400);
return null;
}
Expand Down Expand Up @@ -327,4 +327,8 @@ private static Token decode(String value) {
// Not @Restricted because the entire class is
@SuppressFBWarnings(value = "MS_SHOULD_BE_FINAL", justification = "for script console")
public static /* not final for Groovy */ int VALID_FOR_MINUTES = SystemProperties.getInteger(ResourceDomainRootAction.class.getName() + ".validForMinutes", 30);

/* Escape hatch for a fix part of SECURITY-3314 / CVE-2024-23897 (Variant 2) */
Dohbedoh marked this conversation as resolved.
Show resolved Hide resolved
@SuppressFBWarnings(value = "MS_SHOULD_BE_FINAL", justification = "for script console")
public static /* not final for Groovy */ boolean ALLOW_AUTHENTICATED_USER = SystemProperties.getBoolean(ResourceDomainRootAction.class.getName() + ".allowAuthenticatedUser", false);
}
10 changes: 9 additions & 1 deletion test/src/test/java/jenkins/security/ResourceDomainTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -399,7 +399,7 @@ public HttpResponse doDynamic() throws Exception {
}

@Test
public void authenticatedCannotAccessResourceDomain() throws Exception {
public void authenticatedCannotAccessResourceDomainUnlessAllowedBySystemProperty() throws Exception {
j.jenkins.setSecurityRealm(j.createDummySecurityRealm());
final MockAuthorizationStrategy authorizationStrategy = new MockAuthorizationStrategy();
authorizationStrategy.grant(Jenkins.ADMINISTER).everywhere().to("admin").grant(Jenkins.READ).everywhere().toEveryone();
Expand All @@ -416,5 +416,13 @@ public void authenticatedCannotAccessResourceDomain() throws Exception {
try (JenkinsRule.WebClient wc = j.createWebClient().withBasicCredentials("admin")) {
assertThat(assertThrows(FailingHttpStatusCodeException.class, () -> wc.getPage(new URL(resourceUrl))).getStatusCode(), is(400));
}

ResourceDomainRootAction.ALLOW_AUTHENTICATED_USER = true;
try (JenkinsRule.WebClient wc = j.createWebClient().withBasicApiToken("admin")) {
assertThat(wc.getPage(new URL(resourceUrl)).getWebResponse().getStatusCode(), is(200));
}
try (JenkinsRule.WebClient wc = j.createWebClient().withBasicCredentials("admin")) {
assertThat(wc.getPage(new URL(resourceUrl)).getWebResponse().getStatusCode(), is(200));
}
}
}
Loading