Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
dream21st
jenkins
提交
11479a2c
J
jenkins
项目概览
dream21st
/
jenkins
与 Fork 源项目一致
从无法访问的项目Fork
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
J
jenkins
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
11479a2c
编写于
11月 27, 2015
作者:
D
Daniel Beck
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
[FIX SECURITY-234] Abort plugin/core update on checksum mismatch
上级
f7880ba0
变更
2
隐藏空白更改
内联
并排
Showing
2 changed file
with
67 addition
and
0 deletion
+67
-0
core/src/main/java/hudson/model/UpdateCenter.java
core/src/main/java/hudson/model/UpdateCenter.java
+56
-0
core/src/main/java/hudson/model/UpdateSite.java
core/src/main/java/hudson/model/UpdateSite.java
+11
-0
未找到文件。
core/src/main/java/hudson/model/UpdateCenter.java
浏览文件 @
11479a2c
...
...
@@ -54,6 +54,7 @@ import jenkins.model.Jenkins;
import
jenkins.util.io.OnMaster
;
import
org.acegisecurity.Authentication
;
import
org.acegisecurity.context.SecurityContext
;
import
org.apache.commons.codec.binary.Base64
;
import
org.apache.commons.io.input.CountingInputStream
;
import
org.apache.commons.io.output.NullOutputStream
;
import
org.jvnet.localizer.Localizable
;
...
...
@@ -64,6 +65,7 @@ import org.kohsuke.stapler.StaplerResponse;
import
javax.net.ssl.SSLHandshakeException
;
import
javax.servlet.ServletException
;
import
java.io.File
;
import
java.io.FileInputStream
;
import
java.io.FileOutputStream
;
import
java.io.IOException
;
import
java.io.OutputStream
;
...
...
@@ -71,6 +73,9 @@ import java.net.MalformedURLException;
import
java.net.URL
;
import
java.net.URLConnection
;
import
java.net.UnknownHostException
;
import
java.security.DigestInputStream
;
import
java.security.MessageDigest
;
import
java.security.NoSuchAlgorithmException
;
import
java.util.ArrayList
;
import
java.util.Collections
;
import
java.util.HashSet
;
...
...
@@ -1102,6 +1107,16 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
private
Authentication
authentication
;
/**
* During download, an attempt is made to compute the SHA-1 checksum of the file.
*
* @since TODO
*/
// TODO no new API in LTS, but remove for mainline
@Restricted
(
NoExternalUse
.
class
)
@CheckForNull
protected
String
computedSHA1
;
/**
* Get the user that initiated this job
*/
...
...
@@ -1142,6 +1157,24 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
File
dst
=
getDestination
();
File
tmp
=
config
.
download
(
this
,
src
);
try
{
MessageDigest
sha1
=
MessageDigest
.
getInstance
(
"SHA-1"
);
DigestInputStream
dis
=
new
DigestInputStream
(
new
FileInputStream
(
tmp
),
sha1
);
byte
[]
unused
=
new
byte
[
1024
];
try
{
while
(
dis
.
read
(
unused
)
!=
-
1
)
;
// do nothing, just read the entire file
}
finally
{
dis
.
close
();
}
byte
[]
digest
=
sha1
.
digest
();
computedSHA1
=
Base64
.
encodeBase64String
(
digest
);
}
catch
(
NoSuchAlgorithmException
ignored
)
{
// Irrelevant as the Java spec says SHA-1 must exist. Still, if this fails
// the DownloadJob will just have computedSha1 = null and that is expected
// to be handled by caller
}
config
.
postValidate
(
this
,
tmp
);
config
.
install
(
this
,
tmp
,
dst
);
}
...
...
@@ -1351,6 +1384,18 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
dst
.
renameTo
(
bak
);
}
legacy
.
delete
();
if
(
plugin
.
sha1
!=
null
)
{
if
(
computedSHA1
==
null
)
{
// refuse to install if SHA-1 could not be computed
throw
new
IOException
(
"Failed to compute SHA-1 of downloaded file, refusing installation"
);
}
if
(!
plugin
.
sha1
.
equals
(
computedSHA1
))
{
throw
new
IOException
(
"Downloaded file "
+
src
.
getAbsolutePath
()
+
" does not match expected SHA-1, expected "
+
plugin
.
sha1
+
", actual "
+
computedSHA1
);
// keep 'src' around for investigating what's going on
}
}
dst
.
delete
();
// any failure up to here is no big deal
if
(!
src
.
renameTo
(
dst
))
{
...
...
@@ -1470,6 +1515,17 @@ public class UpdateCenter extends AbstractModelObject implements Saveable, OnMas
@Override
protected
void
replace
(
File
dst
,
File
src
)
throws
IOException
{
String
expectedSHA1
=
site
.
getData
().
core
.
sha1
;
if
(
expectedSHA1
!=
null
)
{
if
(
computedSHA1
==
null
)
{
// refuse to install if SHA-1 could not be computed
throw
new
IOException
(
"Failed to compute SHA-1 of downloaded file, refusing installation"
);
}
if
(!
expectedSHA1
.
equals
(
computedSHA1
))
{
throw
new
IOException
(
"Downloaded file "
+
src
.
getAbsolutePath
()
+
" does not match expected SHA-1, expected "
+
expectedSHA1
+
", actual "
+
computedSHA1
);
// keep 'src' around for investigating what's going on
}
}
Lifecycle
.
get
().
rewriteHudsonWar
(
src
);
}
}
...
...
core/src/main/java/hudson/model/UpdateSite.java
浏览文件 @
11479a2c
...
...
@@ -27,6 +27,7 @@ package hudson.model;
import
hudson.PluginManager
;
import
hudson.PluginWrapper
;
import
hudson.Util
;
import
hudson.lifecycle.Lifecycle
;
import
hudson.model.UpdateCenter.UpdateCenterJob
;
import
hudson.util.FormValidation
;
...
...
@@ -126,6 +127,8 @@ public class UpdateSite {
*/
private
final
String
url
;
public
UpdateSite
(
String
id
,
String
url
)
{
this
.
id
=
id
;
this
.
url
=
url
;
...
...
@@ -507,6 +510,13 @@ public class UpdateSite {
@Exported
public
final
String
url
;
/**
* The base64 encoded binary SHA-1 checksum of the file.
* @since TODO
*/
// TODO @Exported assuming we want this in the API
public
final
String
sha1
;
public
Entry
(
String
sourceId
,
JSONObject
o
)
{
this
(
sourceId
,
o
,
null
);
}
...
...
@@ -515,6 +525,7 @@ public class UpdateSite {
this
.
sourceId
=
sourceId
;
this
.
name
=
o
.
getString
(
"name"
);
this
.
version
=
o
.
getString
(
"version"
);
this
.
sha1
=
Util
.
fixEmpty
(
o
.
optString
(
"sha1"
));
String
url
=
o
.
getString
(
"url"
);
if
(!
URI
.
create
(
url
).
isAbsolute
())
{
if
(
baseURL
==
null
)
{
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录