Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
xxadev
jenkins
提交
f7075e60
J
jenkins
项目概览
xxadev
/
jenkins
与 Fork 源项目一致
从无法访问的项目Fork
通知
3
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
J
jenkins
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
f7075e60
编写于
4月 16, 2017
作者:
D
Daniel Beck
浏览文件
操作
浏览文件
下载
差异文件
Merge branch 'security-stable-2.46' into security-master
上级
745dacc7
59ec1290
变更
4
隐藏空白更改
内联
并排
Showing
4 changed file
with
16 addition
and
2 deletion
+16
-2
core/src/main/java/hudson/util/XStream2.java
core/src/main/java/hudson/util/XStream2.java
+3
-0
core/src/main/java/jenkins/install/SetupWizard.java
core/src/main/java/jenkins/install/SetupWizard.java
+0
-1
core/src/test/java/hudson/util/XStream2Test.java
core/src/test/java/hudson/util/XStream2Test.java
+12
-0
war/src/main/js/api/pluginManager.js
war/src/main/js/api/pluginManager.js
+1
-1
未找到文件。
core/src/main/java/hudson/util/XStream2.java
浏览文件 @
f7075e60
...
...
@@ -145,6 +145,9 @@ public class XStream2 extends XStream {
// list up types that should be marshalled out like a value, without referential integrity tracking.
addImmutableType
(
Result
.
class
);
// http://www.openwall.com/lists/oss-security/2017/04/03/4
denyTypes
(
new
Class
[]
{
void
.
class
,
Void
.
class
});
registerConverter
(
new
RobustCollectionConverter
(
getMapper
(),
getReflectionProvider
()),
10
);
registerConverter
(
new
RobustMapConverter
(
getMapper
()),
10
);
registerConverter
(
new
ImmutableMapConverter
(
getMapper
(),
getReflectionProvider
()),
10
);
...
...
core/src/main/java/jenkins/install/SetupWizard.java
浏览文件 @
f7075e60
...
...
@@ -458,7 +458,6 @@ public class SetupWizard extends PageDecorator {
/**
* Remove the setupWizard filter, ensure all updates are written to disk, etc
*/
@RequirePOST
public
HttpResponse
doCompleteInstall
()
throws
IOException
,
ServletException
{
completeSetup
();
return
HttpResponses
.
okJSON
();
...
...
core/src/test/java/hudson/util/XStream2Test.java
浏览文件 @
f7075e60
...
...
@@ -28,6 +28,7 @@ import static org.junit.Assert.*;
import
com.google.common.collect.ImmutableList
;
import
com.google.common.collect.ImmutableMap
;
import
com.thoughtworks.xstream.XStreamException
;
import
com.thoughtworks.xstream.security.ForbiddenClassException
;
import
hudson.XmlFile
;
import
hudson.model.Result
;
import
hudson.model.Run
;
...
...
@@ -296,4 +297,15 @@ public class XStream2Test {
assertEquals
(
"3.2.1"
,
XStream2
.
trimVersion
(
"3.2.1"
));
assertEquals
(
"3.2-SNAPSHOT"
,
XStream2
.
trimVersion
(
"3.2-SNAPSHOT (private-09/23/2012 12:26-jhacker)"
));
}
@Issue
(
"SECURITY-503"
)
@Test
public
void
crashXstream
()
throws
Exception
{
try
{
new
XStream2
().
fromXML
(
"<void/>"
);
fail
(
"expected to throw ForbiddenClassException, but why are we still alive?"
);
}
catch
(
ForbiddenClassException
ex
)
{
// pass
}
}
}
war/src/main/js/api/pluginManager.js
浏览文件 @
f7075e60
...
...
@@ -177,7 +177,7 @@ exports.incompleteInstallStatus = function(handler, correlationId) {
* Call this to complete the installation without installing anything
*/
exports
.
completeInstall
=
function
(
handler
)
{
jenkins
.
post
(
'
/setupWizard/completeInstall
'
,
{}
,
function
()
{
jenkins
.
get
(
'
/setupWizard/completeInstall
'
,
function
()
{
handler
.
call
({
isError
:
false
});
},
{
timeout
:
pluginManagerErrorTimeoutMillis
,
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录