Skip to content

Commit af4e897

Browse files
author
myroid
committed
Fixed SECURITY-1044
1 parent fac275a commit af4e897

File tree

21 files changed

+77
-64
lines changed

21 files changed

+77
-64
lines changed

‎README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,11 @@ appPgyerURL|Application pgyer url
8484
appBuildURL|Application build pgyer url
8585

8686
### Change Log
87+
Version 1.33(2019-09-07)
88+
89+
- Fixed [SECURITY-1044](https://issues.jenkins-ci.org/browse/SECURITY-1044)
90+
- Upgrade gson 2.8.5
91+
8792
Version 1.31(2018-05-07)
8893

8994
- Upgrade gson 2.8.4

‎README_cn.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,11 @@ appPgyerURL| 应用主页地址
8282
appBuildURL| 本次上传的应用主页
8383

8484
### Change Log
85+
版本 1.33(2019-09-07)
86+
87+
- 修复[SECURITY-1044](https://issues.jenkins-ci.org/browse/SECURITY-1044)
88+
- 升级Gson 2.8.5
89+
8590
版本 1.31(2018-05-07)
8691

8792
- 升级Gson 2.8.4

‎pom.xml‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
34
<modelVersion>4.0.0</modelVersion>
45

56
<properties>
@@ -10,12 +11,12 @@
1011
<groupId>org.jenkins-ci.plugins</groupId>
1112
<artifactId>plugin</artifactId>
1213
<version>2.11</version>
13-
<relativePath />
14+
<relativePath/>
1415
</parent>
1516

1617
<groupId>ren.helloworld</groupId>
1718
<artifactId>upload-pgyer</artifactId>
18-
<version>1.32-SNAPSHOT</version>
19+
<version>1.33-SNAPSHOT</version>
1920
<packaging>hpi</packaging>
2021
<name>Upload to pgyer</name>
2122
<description>Upload to pgyer for jenkins plugin</description>
@@ -33,14 +34,14 @@
3334
<id>myroid</id>
3435
<name>fan yang</name>
3536
<email>myroid@foxmail.com</email>
36-
<url>http://dafan.tech</url>
37-
<organization>Micute</organization>
37+
<url>https://iamfan.cn</url>
38+
<organization>NetEase</organization>
3839
</developer>
3940
</developers>
4041

4142
<organization>
42-
<name>Micute</name>
43-
<url>http://www.91ylian.com/</url>
43+
<name>NetEase</name>
44+
<url>https://www.163.com/</url>
4445
</organization>
4546

4647
<repositories>
@@ -67,7 +68,7 @@
6768
<dependency>
6869
<groupId>com.google.code.gson</groupId>
6970
<artifactId>gson</artifactId>
70-
<version>2.8.4</version>
71+
<version>2.8.5</version>
7172
</dependency>
7273

7374
<dependency>

‎src/main/java/ren/helloworld/upload2pgyer/UploadBuilder.java‎

Lines changed: 13 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import hudson.tasks.BuildStepDescriptor;
99
import hudson.tasks.Builder;
1010
import hudson.util.FormValidation;
11+
import hudson.util.Secret;
1112
import org.jenkinsci.Symbol;
1213
import org.kohsuke.stapler.DataBoundConstructor;
1314
import org.kohsuke.stapler.QueryParameter;
@@ -24,35 +25,35 @@
2425
*/
2526
public class UploadBuilder extends Builder {
2627

27-
private String uKey;
28-
private String apiKey;
28+
private Secret uKey;
29+
private Secret apiKey;
2930
private String scanDir;
3031
private String wildcard;
3132
private String installType;
32-
private String password;
33+
private Secret password;
3334
private String updateDescription;
3435

3536
private String qrcodePath;
3637
private String envVarsPath;
3738

3839
@DataBoundConstructor
3940
public UploadBuilder(String uKey, String apiKey, String scanDir, String wildcard, String installType, String password, String updateDescription, String qrcodePath, String envVarsPath) {
40-
this.uKey = uKey;
41-
this.apiKey = apiKey;
41+
this.uKey = Secret.fromString(uKey);
42+
this.apiKey = Secret.fromString(apiKey);
4243
this.scanDir = scanDir;
4344
this.wildcard = wildcard;
4445
this.installType = installType;
45-
this.password = password;
46+
this.password = Secret.fromString(password);
4647
this.updateDescription = updateDescription;
4748
this.qrcodePath = qrcodePath;
4849
this.envVarsPath = envVarsPath;
4950
}
5051

51-
public String getuKey() {
52+
public Secret getuKey() {
5253
return uKey;
5354
}
5455

55-
public String getApiKey() {
56+
public Secret getApiKey() {
5657
return apiKey;
5758
}
5859

@@ -68,7 +69,7 @@ public String getInstallType() {
6869
return installType;
6970
}
7071

71-
public String getPassword() {
72+
public Secret getPassword() {
7273
return password;
7374
}
7475

@@ -87,12 +88,12 @@ public String getEnvVarsPath() {
8788
@Override
8889
public boolean perform(AbstractBuild<?, ?> build, Launcher launcher, BuildListener listener) throws InterruptedException, IOException {
8990
ParamsBeanV1 paramsBeanV1 = new ParamsBeanV1();
90-
paramsBeanV1.setUkey(uKey);
91-
paramsBeanV1.setApiKey(apiKey);
91+
paramsBeanV1.setUkey(uKey.getPlainText());
92+
paramsBeanV1.setApiKey(apiKey.getPlainText());
9293
paramsBeanV1.setScandir(scanDir);
9394
paramsBeanV1.setWildcard(wildcard);
9495
paramsBeanV1.setInstallType(installType);
95-
paramsBeanV1.setPassword(password);
96+
paramsBeanV1.setPassword(password.getPlainText());
9697
paramsBeanV1.setUpdateDescription(updateDescription);
9798
paramsBeanV1.setQrcodePath(qrcodePath);
9899
paramsBeanV1.setEnvVarsPath(envVarsPath);
@@ -115,17 +116,13 @@ public FormValidation doCheckUKey(@QueryParameter String value)
115116
throws IOException, ServletException {
116117
if (value.length() == 0)
117118
return FormValidation.error("Please set a uKey");
118-
if (!value.matches("[A-Za-z0-9]{32}"))
119-
return FormValidation.warning("Is this correct?");
120119
return FormValidation.ok();
121120
}
122121

123122
public FormValidation doCheckApiKey(@QueryParameter String value)
124123
throws IOException, ServletException {
125124
if (value.length() == 0)
126125
return FormValidation.error("Please set a api_key");
127-
if (!value.matches("[A-Za-z0-9]{32}"))
128-
return FormValidation.warning("Is this correct?");
129126
return FormValidation.ok();
130127
}
131128

‎src/main/java/ren/helloworld/upload2pgyer/UploadBuilderV2.java‎

Lines changed: 9 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import hudson.tasks.BuildStepDescriptor;
99
import hudson.tasks.Builder;
1010
import hudson.util.FormValidation;
11+
import hudson.util.Secret;
1112
import org.jenkinsci.Symbol;
1213
import org.kohsuke.stapler.DataBoundConstructor;
1314
import org.kohsuke.stapler.QueryParameter;
@@ -24,11 +25,11 @@
2425
*/
2526
public class UploadBuilderV2 extends Builder {
2627

27-
private String apiKey;
28+
private Secret apiKey;
2829
private String scanDir;
2930
private String wildcard;
3031
private String buildInstallType;
31-
private String buildPassword;
32+
private Secret buildPassword;
3233
private String buildUpdateDescription;
3334
private String buildName;
3435

@@ -37,18 +38,18 @@ public class UploadBuilderV2 extends Builder {
3738

3839
@DataBoundConstructor
3940
public UploadBuilderV2(String apiKey, String scanDir, String wildcard, String buildName, String buildInstallType, String buildPassword, String buildUpdateDescription, String qrcodePath, String envVarsPath) {
40-
this.apiKey = apiKey;
41+
this.apiKey = Secret.fromString(apiKey);
4142
this.scanDir = scanDir;
4243
this.wildcard = wildcard;
4344
this.buildName = buildName;
44-
this.buildPassword = buildPassword;
45+
this.buildPassword = Secret.fromString(buildPassword);
4546
this.buildInstallType = buildInstallType;
4647
this.buildUpdateDescription = buildUpdateDescription;
4748
this.qrcodePath = qrcodePath;
4849
this.envVarsPath = envVarsPath;
4950
}
5051

51-
public String getApiKey() {
52+
public Secret getApiKey() {
5253
return apiKey;
5354
}
5455

@@ -64,7 +65,7 @@ public String getBuildInstallType() {
6465
return buildInstallType;
6566
}
6667

67-
public String getBuildPassword() {
68+
public Secret getBuildPassword() {
6869
return buildPassword;
6970
}
7071

@@ -87,10 +88,10 @@ public String getEnvVarsPath() {
8788
@Override
8889
public boolean perform(AbstractBuild<?, ?> build, Launcher launcher, BuildListener listener) throws InterruptedException, IOException {
8990
ParamsBeanV2 paramsBeanV2 = new ParamsBeanV2();
90-
paramsBeanV2.setApiKey(apiKey);
91+
paramsBeanV2.setApiKey(apiKey.getPlainText());
9192
paramsBeanV2.setScandir(scanDir);
9293
paramsBeanV2.setWildcard(wildcard);
93-
paramsBeanV2.setBuildPassword(buildPassword);
94+
paramsBeanV2.setBuildPassword(buildPassword.getPlainText());
9495
paramsBeanV2.setBuildInstallType(buildInstallType);
9596
paramsBeanV2.setBuildUpdateDescription(buildUpdateDescription);
9697
paramsBeanV2.setBuildName(buildName);
@@ -115,8 +116,6 @@ public FormValidation doCheckApiKey(@QueryParameter String value)
115116
throws IOException, ServletException {
116117
if (value.length() == 0)
117118
return FormValidation.error("Please set a api_key");
118-
if (!value.matches("[A-Za-z0-9]{32}"))
119-
return FormValidation.warning("Is this correct?");
120119
return FormValidation.ok();
121120
}
122121

‎src/main/java/ren/helloworld/upload2pgyer/UploadPublisher.java‎

Lines changed: 13 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
import hudson.tasks.Publisher;
1111
import hudson.tasks.Recorder;
1212
import hudson.util.FormValidation;
13+
import hudson.util.Secret;
1314
import org.jenkinsci.Symbol;
1415
import org.kohsuke.stapler.DataBoundConstructor;
1516
import org.kohsuke.stapler.QueryParameter;
@@ -26,35 +27,35 @@
2627
*/
2728
public class UploadPublisher extends Recorder {
2829

29-
private String uKey;
30-
private String apiKey;
30+
private Secret uKey;
31+
private Secret apiKey;
3132
private String scanDir;
3233
private String wildcard;
3334
private String installType;
34-
private String password;
35+
private Secret password;
3536
private String updateDescription;
3637

3738
private String qrcodePath;
3839
private String envVarsPath;
3940

4041
@DataBoundConstructor
4142
public UploadPublisher(String uKey, String apiKey, String scanDir, String wildcard, String installType, String password, String updateDescription, String qrcodePath, String envVarsPath) {
42-
this.uKey = uKey;
43-
this.apiKey = apiKey;
43+
this.uKey = Secret.fromString(uKey);
44+
this.apiKey = Secret.fromString(apiKey);
4445
this.scanDir = scanDir;
4546
this.wildcard = wildcard;
4647
this.installType = installType;
47-
this.password = password;
48+
this.password = Secret.fromString(password);
4849
this.updateDescription = updateDescription;
4950
this.qrcodePath = qrcodePath;
5051
this.envVarsPath = envVarsPath;
5152
}
5253

53-
public String getuKey() {
54+
public Secret getuKey() {
5455
return uKey;
5556
}
5657

57-
public String getApiKey() {
58+
public Secret getApiKey() {
5859
return apiKey;
5960
}
6061

@@ -70,7 +71,7 @@ public String getInstallType() {
7071
return installType;
7172
}
7273

73-
public String getPassword() {
74+
public Secret getPassword() {
7475
return password;
7576
}
7677

@@ -89,12 +90,12 @@ public String getEnvVarsPath() {
8990
@Override
9091
public boolean perform(AbstractBuild<?, ?> build, Launcher launcher, BuildListener listener) throws InterruptedException, IOException {
9192
ParamsBeanV1 bean = new ParamsBeanV1();
92-
bean.setApiKey(apiKey);
93-
bean.setUkey(uKey);
93+
bean.setApiKey(apiKey.getPlainText());
94+
bean.setUkey(uKey.getPlainText());
9495
bean.setScandir(scanDir);
9596
bean.setWildcard(wildcard);
9697
bean.setInstallType(installType);
97-
bean.setPassword(password);
98+
bean.setPassword(password.getPlainText());
9899
bean.setUpdateDescription(updateDescription);
99100
bean.setQrcodePath(qrcodePath);
100101
bean.setEnvVarsPath(envVarsPath);
@@ -117,17 +118,13 @@ public FormValidation doCheckUKey(@QueryParameter String value)
117118
throws IOException, ServletException {
118119
if (value.length() == 0)
119120
return FormValidation.error("Please set a uKey");
120-
if (!value.matches("[A-Za-z0-9]{32}"))
121-
return FormValidation.warning("Is this correct?");
122121
return FormValidation.ok();
123122
}
124123

125124
public FormValidation doCheckApiKey(@QueryParameter String value)
126125
throws IOException, ServletException {
127126
if (value.length() == 0)
128127
return FormValidation.error("Please set a api_key");
129-
if (!value.matches("[A-Za-z0-9]{32}"))
130-
return FormValidation.warning("Is this correct?");
131128
return FormValidation.ok();
132129
}
133130

0 commit comments

Comments
 (0)