Merge branch 'security-stable-2.190' into security-stable-2.204

core/src/main/java/hudson/model/FileParameterValue.java

@@ -40,6 +40,7 @@ import java.nio.file.Path;
 import java.util.regex.Pattern;
 import javax.servlet.ServletException;
 
+import jenkins.util.SystemProperties;
 import org.apache.commons.fileupload.FileItem;
 import org.apache.commons.fileupload.FileItemHeaders;
 import org.apache.commons.fileupload.disk.DiskFileItem;
@@ -251,6 +252,13 @@ public class FileParameterValue extends ParameterValue {
                     if (request.hasParameter("view")) {
                         response.serveFile(request, data, lastModified, contentLength, "plain.txt");
                     } else {
+                        String csp = SystemProperties.getString(DirectoryBrowserSupport.class.getName() + ".CSP", DirectoryBrowserSupport.DEFAULT_CSP_VALUE);
+                        if (!csp.trim().equals("")) {
+                            // allow users to prevent sending this header by setting empty system property
+                            for (String header : new String[]{"Content-Security-Policy", "X-WebKit-CSP", "X-Content-Security-Policy"}) {
+                                response.setHeader(header, csp);
+                            }
+                        }
                         response.serveFile(request, data, lastModified, contentLength, originalFileName);
                     }
                 } catch (InvalidPathException e) {

core/src/main/java/hudson/model/Label.java

@@ -26,6 +26,7 @@ package hudson.model;
 import antlr.ANTLRException;
 import static hudson.Util.fixNull;
 
+import hudson.Util;
 import hudson.model.labels.LabelAtom;
 import hudson.model.labels.LabelExpression;
 import hudson.model.labels.LabelExpression.And;
@@ -150,7 +151,7 @@ public abstract class Label extends Actionable implements Comparable<Label>, Mod
      * Relative URL from the context path, that ends with '/'.
      */
     public String getUrl() {
-        return "label/"+name+'/';
+        return "label/" + Util.rawEncode(name) + '/';
     }
 
     public String getSearchUrl() {

core/src/main/java/hudson/security/csrf/CrumbFilter.java

@@ -7,6 +7,7 @@ package hudson.security.csrf;
 
 import hudson.util.MultipartFormDataParser;
 import jenkins.model.Jenkins;
+import jenkins.util.SystemProperties;
 import org.acegisecurity.providers.anonymous.AnonymousAuthenticationToken;
 import org.kohsuke.MetaInfServices;
 import org.kohsuke.accmod.Restricted;
@@ -15,7 +16,10 @@ import org.kohsuke.stapler.ForwardToView;
 import org.kohsuke.stapler.interceptor.RequirePOST;
 
 import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Enumeration;
+import java.util.List;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
@@ -26,6 +30,7 @@ import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
 import javax.servlet.http.HttpServletResponse;
 
 /**
@@ -58,6 +63,54 @@ public class CrumbFilter implements Filter {
     public void init(FilterConfig filterConfig) throws ServletException {
     }
 
+    private static class Security1774ServletRequest extends HttpServletRequestWrapper {
+        public Security1774ServletRequest(HttpServletRequest request) {
+            super(request);
+        }
+
+        @Override
+        public String getPathInfo() {
+            // see Stapler#getServletPath
+            return canonicalPath(getRequestURI().substring(getContextPath().length()));
+        }
+
+
+        // Copied from Stapler#canonicalPath
+        private static String canonicalPath(String path) {
+            List<String> r = new ArrayList<String>(Arrays.asList(path.split("/+")));
+            for (int i=0; i<r.size(); ) {
+                if (r.get(i).length()==0 || r.get(i).equals(".")) {
+                    // empty token occurs for example, "".split("/+") is [""]
+                    r.remove(i);
+                } else
+                if (r.get(i).equals("..")) {
+                    // i==0 means this is a broken URI.
+                    r.remove(i);
+                    if (i>0) {
+                        r.remove(i-1);
+                        i--;
+                    }
+                } else {
+                    i++;
+                }
+            }
+
+            StringBuilder buf = new StringBuilder();
+            if (path.startsWith("/"))
+                buf.append('/');
+            boolean first = true;
+            for (String token : r) {
+                if (!first)     buf.append('/');
+                else            first = false;
+                buf.append(token);
+            }
+            // translation: if (path.endsWith("/") && !buf.endsWith("/"))
+            if (path.endsWith("/") && (buf.length()==0 || buf.charAt(buf.length()-1)!='/'))
+                buf.append('/');
+            return buf.toString();
+        }
+    }
+
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
         CrumbIssuer crumbIssuer = getCrumbIssuer();
         if (crumbIssuer == null || !(request instanceof HttpServletRequest)) {
@@ -69,8 +122,9 @@ public class CrumbFilter implements Filter {
         HttpServletResponse httpResponse = (HttpServletResponse) response;
 
         if ("POST".equals(httpRequest.getMethod())) {
+            HttpServletRequest wrappedRequest = UNPROCESSED_PATHINFO ? httpRequest : new Security1774ServletRequest(httpRequest);
             for (CrumbExclusion e : CrumbExclusion.all()) {
-                if (e.process(httpRequest,httpResponse,chain))
+                if (e.process(wrappedRequest,httpResponse,chain))
                     return;
             }
 
@@ -133,5 +187,7 @@ public class CrumbFilter implements Filter {
     public void destroy() {
     }
 
+    static /* non-final for Groovy */ boolean UNPROCESSED_PATHINFO = SystemProperties.getBoolean(CrumbFilter.class.getName() + ".UNPROCESSED_PATHINFO");
+
     private static final Logger LOGGER = Logger.getLogger(CrumbFilter.class.getName());
 }

core/src/main/java/jenkins/model/Jenkins.java

@@ -1980,6 +1980,8 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
 
             // non-existent
             try {
+                // For the record, this method creates temporary labels but there is a periodic task
+                // calling "trimLabels" to remove unused labels running every 5 minutes.
                 labels.putIfAbsent(expr,Label.parseExpression(expr));
             } catch (ANTLRException e) {
                 // laxly accept it as a single label atom for backward compatibility
@@ -2002,6 +2004,8 @@ public class Jenkins extends AbstractCIBase implements DirectlyModifiableTopLeve
 
             // non-existent
             LabelAtom la = new LabelAtom(name);
+            // For the record, this method creates temporary labels but there is a periodic task
+            // calling "trimLabels" to remove unused labels running every 5 minutes.
             if (labels.putIfAbsent(name, la)==null)
                 la.load();
         }

core/src/main/java/jenkins/security/SuspiciousRequestFilter.java

+package jenkins.security;
+
+import jenkins.util.SystemProperties;
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.logging.Logger;
+
+@Restricted(NoExternalUse.class)
+public class SuspiciousRequestFilter implements Filter {
+
+    /** System property name set to true or false to indicate whether or not semicolons should be allowed in URL paths. */
+    public static final String ALLOW_SEMICOLONS_IN_PATH = SuspiciousRequestFilter.class.getName() + ".allowSemicolonsInPath";
+    public static boolean allowSemicolonsInPath = SystemProperties.getBoolean(ALLOW_SEMICOLONS_IN_PATH, false);
+    private static final Logger LOGGER = Logger.getLogger(SuspiciousRequestFilter.class.getName());
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+        HttpServletRequest httpRequest = (HttpServletRequest) request;
+        HttpServletResponse httpResponse = (HttpServletResponse) response;
+        if (!allowSemicolonsInPath && httpRequest.getRequestURI().contains(";")) {
+            LOGGER.warning(() -> "Denying HTTP " + httpRequest.getMethod() + " to " + httpRequest.getRequestURI() +
+                    " as it has an illegal semicolon in the path. This behavior can be overridden by setting the system property " +
+                    ALLOW_SEMICOLONS_IN_PATH + " to true. For more information, see https://jenkins.io/redirect/semicolons-in-urls");
+            httpResponse.sendError(HttpServletResponse.SC_BAD_REQUEST, "Semicolons are not allowed in the request URI");
+        } else {
+            chain.doFilter(request, response);
+        }
+    }
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+    }
+
+    @Override
+    public void destroy() {
+    }
+}

core/src/main/resources/hudson/views/ListViewColumn/columnHeader.jelly

@@ -20,6 +20,15 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
+-->
+
+<!--
+Warning, if you do want to inject HTML code in a column header, you have to do so using Jelly.
+Example:
+    <th><strong>${it.columnCaption}</strong></th>
+
+If you do it using variable, the content will be escaped by Jelly and not displayed as you expected.
+In such case, if you force the un-escaping with j:out, this could lead to XSS if the content is not fully trusted.
 -->
 
  <?jelly escape-by-default='true'?>

test/src/test/java/hudson/model/AbstractProjectSEC1781Test.java

+package hudson.model;
+
+import com.gargoylesoftware.htmlunit.html.DomNode;
+import com.gargoylesoftware.htmlunit.html.DomNodeList;
+import com.gargoylesoftware.htmlunit.html.HtmlAnchor;
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import hudson.Util;
+import org.junit.Rule;
+import org.junit.Test;
+import org.jvnet.hudson.test.Issue;
+import org.jvnet.hudson.test.JenkinsRule;
+
+import static org.hamcrest.Matchers.allOf;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.hasSize;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertThat;
+
+//TODO merge back to AbstractProjectTest when security release is done. 
+// Creating a different test class is used to ease the security merge process.
+public class AbstractProjectSEC1781Test {
+
+    @Rule
+    public JenkinsRule j = new JenkinsRule();
+
+    @Test
+    public void ensureWhenNonExistingLabelsProposalsAreMade() throws Exception {
+        j.jenkins.setCrumbIssuer(null);
+        FreeStyleProject p = j.createFreeStyleProject();
+
+        String label = "whatever";
+        HtmlPage htmlPage = this.requestCheckAssignedLabelString(p, label);
+        String responseContent = htmlPage.getWebResponse().getContentAsString();
+        /* Sample:
+         *
+         * <div class=warning><img src='/jenkins/static/03a3de4a/images/none.gif' height=16 width=1>There’s no agent/cloud that
+         *     matches this assignment. Did you mean ‘master’ instead of ‘whatever’?
+         * </div>
+         */
+        assertThat(responseContent, allOf(
+                containsString("warning"),
+                // as there is only master that is currently used, it's de facto the nearest to whatever
+                containsString("master"),
+                containsString("whatever")
+        ));
+    }
+
+    @Test
+    public void ensureLegitLabelsAreRetrievedCorrectly() throws Exception {
+        j.jenkins.setCrumbIssuer(null);
+        j.jenkins.setLabelString("existing");
+        FreeStyleProject p = j.createFreeStyleProject();
+
+        String label = "existing";
+        HtmlPage htmlPage = this.requestCheckAssignedLabelString(p, label);
+        String responseContent = htmlPage.getWebResponse().getContentAsString();
+        /* Sample:
+         *
+         * <div class=ok><img src='/jenkins/static/32591acf/images/none.gif' height=16 width=1>
+         *   <a href="http://localhost:5595/jenkins/label/existing/">Label existing</a>
+         *   is serviced by 1 node. Permissions or other restrictions provided by plugins may prevent 
+         *   this job from running on those nodes.
+         * </div>
+         */
+        assertThat(responseContent, allOf(
+                containsString("ok"),
+                containsString("label/existing/\">")
+        ));
+    }
+
+    @Test
+    @Issue("SECURITY-1781")
+    public void dangerousLabelsAreEscaped() throws Exception {
+        j.jenkins.setCrumbIssuer(null);
+
+        // unescaped: "\"><img src=x onerror=alert(123)>"
+        String label = "\"\\\"><img src=x onerror=alert(123)>\"";
+        j.jenkins.setLabelString(label);
+        FreeStyleProject p = j.createFreeStyleProject();
+
+        HtmlPage htmlPage = this.requestCheckAssignedLabelString(p, label);
+        String responseContent = htmlPage.getWebResponse().getContentAsString();
+        /* Sample (before correction)
+         *
+         * <div class=ok><img src='/jenkins/static/793045c3/images/none.gif' height=16 width=1>
+         *   <a href="http://localhost:5718/jenkins/label/"><img src=x onerror=alert(123)>/">Label &quot;&gt;&lt;img src=x 
+         *      onerror=alert(123)&gt;</a>
+         *   is serviced by 1 node. Permissions or other restrictions provided by plugins may prevent
+         *   this job from running on those nodes.
+         * </div>
+         */
+        /* Sample (after correction)
+         * <div class=ok><img src='/jenkins/static/e16858e2/images/none.gif' height=16 width=1>
+         *   <a href="http://localhost:6151/jenkins/label/%22%3E%3Cimg%20src=x%20onerror=alert(123)%3E/">
+         *     Label &quot;&gt;&lt;img src=x onerror=alert(123)&gt;</a> 
+         *   is serviced by 1 node. 
+         *   Permissions or other restrictions provided by plugins may prevent this job from running on those nodes.
+         * </div>
+         */
+        DomNodeList<DomNode> domNodes = htmlPage.getDocumentElement().querySelectorAll("*");
+        assertThat(domNodes, hasSize(5));
+        assertEquals("head", domNodes.get(0).getNodeName());
+        assertEquals("body", domNodes.get(1).getNodeName());
+        assertEquals("div", domNodes.get(2).getNodeName());
+        assertEquals("img", domNodes.get(3).getNodeName());
+        assertEquals("a", domNodes.get(4).getNodeName());
+
+        // only: "><img src=x onerror=alert(123)>
+        // the first double quote was escaped during creation (with the backslash)
+        String unquotedLabel = Label.parseExpression(label).getName();
+        HtmlAnchor anchor = (HtmlAnchor) domNodes.get(4);
+        assertThat(anchor.getHrefAttribute(), containsString(Util.rawEncode(unquotedLabel)));
+
+        assertThat(responseContent, containsString("ok"));
+    }
+
+    private HtmlPage requestCheckAssignedLabelString(FreeStyleProject p, String label) throws Exception {
+        return j.createWebClient().goTo(p.getUrl() + p.getDescriptor().getDescriptorUrl() + "/checkAssignedLabelString?value=" + Util.rawEncode(label));
+    }
+}

test/src/test/java/hudson/model/FileParameterValueSecurity1793Test.java

+package hudson.model;
+
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import org.junit.Ignore;
+import org.junit.Rule;
+import org.junit.Test;
+import org.jvnet.hudson.test.Issue;
+import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.recipes.LocalData;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+
+public class FileParameterValueSecurity1793Test {
+
+    @Rule
+    public JenkinsRule j = new JenkinsRule();
+
+    @Issue("SECURITY-1793")
+    @Test
+    @LocalData
+    public void contentSecurityPolicy() throws Exception {
+        FreeStyleProject p = j.jenkins.getItemByFullName("SECURITY-1793", FreeStyleProject.class);
+
+        HtmlPage page = j.createWebClient().goTo("job/" + p.getName() + "/lastSuccessfulBuild/parameters/parameter/html.html/html.html");
+        for (String header : new String[]{"Content-Security-Policy", "X-WebKit-CSP", "X-Content-Security-Policy"}) {
+            assertEquals("Header set: " + header, DirectoryBrowserSupport.DEFAULT_CSP_VALUE, page.getWebResponse().getResponseHeaderValue(header));
+        }
+
+        String propName = DirectoryBrowserSupport.class.getName() + ".CSP";
+        String initialValue = System.getProperty(propName);
+        try {
+            System.setProperty(propName, "");
+            page = j.createWebClient().goTo("job/" + p.getName() + "/lastSuccessfulBuild/parameters/parameter/html.html/html.html");
+            for (String header : new String[]{"Content-Security-Policy", "X-WebKit-CSP", "X-Content-Security-Policy"}) {
+                assertFalse("Header not set: " + header, page.getWebResponse().getResponseHeaders().contains(header));
+            }
+        } finally {
+            if (initialValue == null) {
+                System.clearProperty(DirectoryBrowserSupport.class.getName() + ".CSP");
+            } else {
+                System.setProperty(DirectoryBrowserSupport.class.getName() + ".CSP", initialValue);
+            }
+        }
+    }
+
+}

test/src/test/java/hudson/security/csrf/CrumbExclusionTest.java

+/*
+ * The MIT License
+ *
+ * Copyright 2020 CloudBees, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package hudson.security.csrf;
+
+import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
+import com.gargoylesoftware.htmlunit.HttpMethod;
+import com.gargoylesoftware.htmlunit.WebRequest;
+
+import java.io.IOException;
+import java.net.URL;
+
+import hudson.ExtensionList;
+import hudson.model.UnprotectedRootAction;
+import jenkins.model.Jenkins;
+import static org.hamcrest.Matchers.containsString;
+
+import jenkins.security.SuspiciousRequestFilter;
+import org.junit.AfterClass;
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import static org.junit.Assert.*;
+import org.junit.Rule;
+import org.jvnet.hudson.test.Issue;
+import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.MockAuthorizationStrategy;
+import org.jvnet.hudson.test.TestExtension;
+import org.kohsuke.stapler.verb.POST;
+
+import javax.annotation.CheckForNull;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class CrumbExclusionTest {
+
+    @Rule
+    public JenkinsRule r = new JenkinsRule();
+
+    @BeforeClass
+    public static void prepare() {
+        SuspiciousRequestFilter.allowSemicolonsInPath = true;
+    }
+
+    @AfterClass
+    public static void cleanup() {
+        SuspiciousRequestFilter.allowSemicolonsInPath = false;
+    }
+
+    @Issue("SECURITY-1774")
+    @Test
+    public void pathInfo() throws Exception {
+        r.jenkins.setSecurityRealm(r.createDummySecurityRealm());
+        r.jenkins.setAuthorizationStrategy(new MockAuthorizationStrategy().grant(Jenkins.ADMINISTER).everywhere().to("admin"));
+        for (String path : new String[] {/* control */ "scriptText", /* test */ "scriptText/..;/cli"}) {
+            try {
+                fail(path + " should have been rejected: " + r.createWebClient().login("admin").getPage(new WebRequest(new URL(r.getURL(), path + "?script=11*11"), HttpMethod.POST)).getWebResponse().getContentAsString());
+            } catch (FailingHttpStatusCodeException x) {
+                assertEquals("status code using " + path, 403, x.getStatusCode());
+                assertThat("error message using " + path, x.getResponse().getContentAsString(), containsString("No valid crumb was included in the request"));
+            }
+        }
+    }
+
+    @Test
+    public void regular() throws Exception {
+        r.createWebClient().getPage(new WebRequest(new URL(r.getURL(), "root/"), HttpMethod.POST));
+        Assert.assertTrue(ExtensionList.lookupSingleton(RootActionImpl.class).posted);
+    }
+
+    @TestExtension
+    public static class RootActionImpl implements UnprotectedRootAction {
+
+        public boolean posted = false;
+
+        @CheckForNull
+        public String getIconFileName() {
+            return null;
+        }
+
+        @CheckForNull
+        public String getDisplayName() {
+            return null;
+        }
+
+        @CheckForNull
+        public String getUrlName() {
+            return "root";
+        }
+
+        @POST
+        public void doIndex() {
+            posted = true;
+        }
+    }
+
+    @TestExtension
+    public static class CrumbExclusionImpl extends CrumbExclusion {
+
+        @Override
+        public boolean process(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException {
+            String pathInfo = request.getPathInfo();
+            if (pathInfo != null && pathInfo.startsWith("/root/")) {
+                chain.doFilter(request, response);
+                return true;
+            }
+            return false;
+        }
+    }
+}

test/src/test/java/jenkins/security/SuspiciousRequestFilterTest.java

+package jenkins.security;
+
+import com.gargoylesoftware.htmlunit.WebRequest;
+import com.gargoylesoftware.htmlunit.WebResponse;
+import hudson.ExtensionList;
+import hudson.model.UnprotectedRootAction;
+import org.junit.Rule;
+import org.junit.Test;
+import org.jvnet.hudson.test.Issue;
+import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.TestExtension;
+import org.kohsuke.stapler.QueryParameter;
+import org.kohsuke.stapler.verb.GET;
+
+import javax.annotation.CheckForNull;
+import javax.servlet.http.HttpServletResponse;
+import java.net.URL;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.is;
+import static org.hamcrest.Matchers.nullValue;
+
+@Issue("SECURITY-1774")
+public class SuspiciousRequestFilterTest {
+
+    @Rule
+    public JenkinsRule j = new JenkinsRule();
+
+    private WebResponse get(String path) throws Exception {
+        return j.createWebClient()
+                .withThrowExceptionOnFailingStatusCode(false)
+                .getPage(new WebRequest(new URL(j.getURL(), path)))
+                .getWebResponse();
+    }
+
+    @Test
+    public void denySemicolonInRequestPathByDefault() throws Exception {
+        WebResponse response = get("foo/bar/..;/?baz=bruh");
+        assertThat(Foo.getInstance().baz, is(nullValue()));
+        assertThat(response.getStatusCode(), is(HttpServletResponse.SC_BAD_REQUEST));
+        assertThat(response.getContentAsString(), containsString("Semicolons are not allowed in the request URI"));
+    }
+
+    @Test
+    public void allowSemicolonsInRequestPathWhenEscapeHatchEnabled() throws Exception {
+        SuspiciousRequestFilter.allowSemicolonsInPath = true;
+        try {
+            WebResponse response = get("foo/bar/..;/..;/cli?baz=bruh");
+            assertThat(Foo.getInstance().baz, is("bruh"));
+            assertThat(response.getStatusCode(), is(HttpServletResponse.SC_OK));
+        } finally {
+            SuspiciousRequestFilter.allowSemicolonsInPath = false;
+        }
+    }
+
+    @Test
+    public void allowSemicolonsInQueryParameters() throws Exception {
+        WebResponse response = get("foo/bar?baz=foo;bar=baz");
+        assertThat(Foo.getInstance().baz, is("foo;bar=baz"));
+        assertThat(response.getStatusCode(), is(HttpServletResponse.SC_OK));
+    }
+
+    @TestExtension
+    public static class Foo implements UnprotectedRootAction {
+
+        private static Foo getInstance() {
+            return ExtensionList.lookupSingleton(Foo.class);
+        }
+
+        private String baz;
+
+        @CheckForNull
+        @Override
+        public String getIconFileName() {
+            return null;
+        }
+
+        @CheckForNull
+        @Override
+        public String getDisplayName() {
+            return "Pitied Foos";
+        }
+
+        @CheckForNull
+        @Override
+        public String getUrlName() {
+            return "foo";
+        }
+
+        @GET
+        public void doBar(@QueryParameter String baz) {
+            this.baz = baz;
+        }
+
+        @GET
+        public void doIndex(@QueryParameter String baz) {
+            this.baz = "index: " + baz;
+        }
+    }
+
+}

test/src/test/resources/hudson/model/FileParameterValueSecurity1793Test/contentSecurityPolicy/jobs/SECURITY-1793/builds/4/build.xml

+<?xml version='1.1' encoding='UTF-8'?>
+<build>
+  <actions>
+    <hudson.model.ParametersAction>
+      <safeParameters class="sorted-set"/>
+      <parameters>
+        <hudson.model.FileParameterValue>
+          <name>html.html</name>
+          <description></description>
+          <originalFileName>html.html</originalFileName>
+          <location>html.html</location>
+        </hudson.model.FileParameterValue>
+      </parameters>
+      <parameterDefinitionNames>
+        <string>html.html</string>
+      </parameterDefinitionNames>
+    </hudson.model.ParametersAction>
+    <hudson.model.CauseAction>
+      <causeBag class="linked-hash-map">
+        <entry>
+          <hudson.model.Cause_-UserIdCause>
+            <userId>admin</userId>
+          </hudson.model.Cause_-UserIdCause>
+          <int>1</int>
+        </entry>
+      </causeBag>
+    </hudson.model.CauseAction>
+  </actions>
+  <queueId>28</queueId>
+  <timestamp>1582828801817</timestamp>
+  <startTime>1582828801820</startTime>
+  <result>SUCCESS</result>
+  <duration>34</duration>
+  <charset>US-ASCII</charset>
+  <keepLog>false</keepLog>
+  <builtOn></builtOn>
+  <workspace>/.../SECURITY-1793</workspace>
+  <hudsonVersion>2.164.4-SNAPSHOT</hudsonVersion>
+  <scm class="hudson.scm.NullChangeLogParser"/>
+  <culprits class="com.google.common.collect.EmptyImmutableSortedSet"/>
+</build>
\ No newline at end of file

test/src/test/resources/hudson/model/FileParameterValueSecurity1793Test/contentSecurityPolicy/jobs/SECURITY-1793/builds/4/changelog.xml

+<log/>
\ No newline at end of file

test/src/test/resources/hudson/model/FileParameterValueSecurity1793Test/contentSecurityPolicy/jobs/SECURITY-1793/builds/4/fileParameters/html.html

+<html>
+<body>
+<script>
+alert(1);
+</script>
+</body>
+</html>
\ No newline at end of file

test/src/test/resources/hudson/model/FileParameterValueSecurity1793Test/contentSecurityPolicy/jobs/SECURITY-1793/builds/4/log

+Building in workspace /.../SECURITY-1793
+Copying file to html.html
+Finished: SUCCESS

test/src/test/resources/hudson/model/FileParameterValueSecurity1793Test/contentSecurityPolicy/jobs/SECURITY-1793/config.xml

+<?xml version='1.1' encoding='UTF-8'?>
+<project>
+  <description></description>
+  <keepDependencies>false</keepDependencies>
+  <properties>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <hudson.model.FileParameterDefinition>
+          <name>html.html</name>
+          <description></description>
+        </hudson.model.FileParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <canRoam>true</canRoam>
+  <disabled>false</disabled>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <triggers/>
+  <concurrentBuild>false</concurrentBuild>
+  <builders/>
+  <publishers/>
+  <buildWrappers/>
+</project>
\ No newline at end of file

war/src/main/webapp/WEB-INF/web.xml

@@ -50,6 +50,11 @@ THE SOFTWARE.
     <url-pattern>/*</url-pattern>
   </servlet-mapping>
 
+  <filter>
+    <filter-name>suspicious-request-filter</filter-name>
+    <filter-class>jenkins.security.SuspiciousRequestFilter</filter-class>
+    <async-supported>true</async-supported>
+  </filter>
   <filter>
     <filter-name>diagnostic-name-filter</filter-name>
     <filter-class>org.kohsuke.stapler.DiagnosticThreadNameFilter</filter-class>
@@ -125,7 +130,11 @@ THE SOFTWARE.
     <url-pattern>*.png</url-pattern>
   </filter-mapping>
   -->
-  
+
+  <filter-mapping>
+    <filter-name>suspicious-request-filter</filter-name>
+    <url-pattern>/*</url-pattern>
+  </filter-mapping>
   <filter-mapping>
     <filter-name>diagnostic-name-filter</filter-name>
     <url-pattern>/*</url-pattern>

war/src/main/webapp/scripts/sortable.js

@@ -55,7 +55,13 @@ var Sortable = (function() {
 
         // We have a first row: assume it's the header, and make its contents clickable links
         firstRow.each(function (cell){
-            cell.innerHTML = '<a href="#" class="sortheader">'+this.getInnerText(cell)+'<span class="sortarrow"></span></a>';
+            /*
+             * Normally the innerHTML is dangerous, but in this case, we receive the column caption from an escaped jelly
+             * and thus, the content there is already escaped.
+             * If we use innerText, we will get the unescaped version and potentially trigger a XSS.
+             * Using the innerHTML will return the escaped content that could be reused directly within the wrapper.
+             */
+            cell.innerHTML = '<a href="#" class="sortheader">'+cell.innerHTML+'<span class="sortarrow"></span></a>';
             this.arrows.push(cell.firstChild.lastChild);
 
             var self = this;