Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
LinuxSuRen
jenkins
提交
d41b0cb2
J
jenkins
项目概览
LinuxSuRen
/
jenkins
与 Fork 源项目一致
从无法访问的项目Fork
通知
2
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
J
jenkins
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
d41b0cb2
编写于
1月 13, 2020
作者:
J
Jeff Thompson
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Convert to not show the trace to admins.
Show it to everybody if the system property is set.
上级
fff47bb6
变更
2
隐藏空白更改
内联
并排
Showing
2 changed file
with
11 addition
and
19 deletion
+11
-19
core/src/main/java/jenkins/security/SuppressionFilter.java
core/src/main/java/jenkins/security/SuppressionFilter.java
+3
-1
test/src/test/java/jenkins/security/SuppressionFilterTest.java
...src/test/java/jenkins/security/SuppressionFilterTest.java
+8
-18
未找到文件。
core/src/main/java/jenkins/security/SuppressionFilter.java
浏览文件 @
d41b0cb2
...
...
@@ -57,6 +57,8 @@ import static javax.servlet.http.HttpServletResponse.SC_INTERNAL_SERVER_ERROR;
@Restricted
(
NoExternalUse
.
class
)
public
class
SuppressionFilter
implements
Filter
{
public
static
boolean
SHOW_STACK_TRACE
=
Boolean
.
getBoolean
(
SuppressionFilter
.
class
.
getName
()
+
".SHOW_STACK_TRACE"
);
private
static
final
Logger
LOGGER
=
Logger
.
getLogger
(
SuppressionFilter
.
class
.
getName
());
@Initializer
(
after
=
InitMilestone
.
STARTED
)
...
...
@@ -154,7 +156,7 @@ public class SuppressionFilter implements Filter {
}
private
static
boolean
showStackTrace
()
{
return
Jenkins
.
get
().
hasPermission
(
Jenkins
.
ADMINISTER
)
;
return
SHOW_STACK_TRACE
;
}
private
AccessDeniedException
containsAccessDeniedException
(
Exception
exception
)
{
...
...
test/src/test/java/jenkins/security/SuppressionFilterTest.java
浏览文件 @
d41b0cb2
...
...
@@ -26,6 +26,7 @@ package jenkins.security;
import
com.gargoylesoftware.htmlunit.Page
;
import
hudson.model.User
;
import
jenkins.model.Jenkins
;
import
org.junit.Before
;
import
org.junit.Ignore
;
import
org.junit.Rule
;
import
org.junit.Test
;
...
...
@@ -42,6 +43,11 @@ public class SuppressionFilterTest {
@Rule
public
JenkinsRule
j
=
new
JenkinsRule
();
@Before
public
void
setup
()
{
SuppressionFilter
.
SHOW_STACK_TRACE
=
false
;
}
@Test
public
void
authenticationException
()
throws
Exception
{
j
.
jenkins
.
setSecurityRealm
(
j
.
createDummySecurityRealm
());
...
...
@@ -58,23 +64,6 @@ public class SuppressionFilterTest {
assertThat
(
content
,
not
(
containsString
(
"Caused by"
)));
}
@Ignore
(
"Doesn't work because the admin user gets to see everything currently"
)
@Test
public
void
authenticationExceptionShowsTrace
()
throws
Exception
{
j
.
jenkins
.
setSecurityRealm
(
j
.
createDummySecurityRealm
());
j
.
jenkins
.
setAuthorizationStrategy
(
new
MockAuthorizationStrategy
().
grant
(
Jenkins
.
ADMINISTER
).
everywhere
().
to
(
"alice"
));
User
alice
=
User
.
get
(
"alice"
);
JenkinsRule
.
WebClient
wc
=
j
.
createWebClient
();
wc
.
login
(
alice
.
getId
());
wc
.
setThrowExceptionOnFailingStatusCode
(
false
);
Page
page
=
wc
.
goTo
(
"configureSecurity"
);
String
content
=
page
.
getWebResponse
().
getContentAsString
();
assertThat
(
content
,
containsString
(
alice
.
getId
()
+
" is missing the Overall/Administer permission"
));
assertThat
(
content
,
containsString
(
"Caused by"
));
}
@Test
public
void
nonexistentPath
()
throws
Exception
{
// This test doesn't really belong here. It really belongs in Stapler.
...
...
@@ -137,10 +126,11 @@ public class SuppressionFilterTest {
// This test probably doesn't belong here. It depends upon how we
// end up implementing. Probably really belongs in Stapler.
j
.
jenkins
.
setSecurityRealm
(
j
.
createDummySecurityRealm
());
j
.
jenkins
.
setAuthorizationStrategy
(
new
MockAuthorizationStrategy
().
grant
(
Jenkins
.
ADMINISTER
).
everywhere
().
to
(
"alice"
));
j
.
jenkins
.
setAuthorizationStrategy
(
new
MockAuthorizationStrategy
().
grant
(
Jenkins
.
READ
).
everywhere
().
to
(
"alice"
));
User
alice
=
User
.
get
(
"alice"
);
JenkinsRule
.
WebClient
wc
=
j
.
createWebClient
();
wc
.
login
(
alice
.
getId
());
SuppressionFilter
.
SHOW_STACK_TRACE
=
true
;
wc
.
setThrowExceptionOnFailingStatusCode
(
false
);
Page
page
=
wc
.
goTo
(
"adjuncts/40331c1bldu3i%3b//'%3b//\"%3b//%25>%3f>uezm3<script>alert(1)</script>foo/org/kohsuke/stapler/jquery/jquery.full.js"
,
"text/plain"
);
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录