Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-47736

JEP-200: Switch Remoting/XStream blacklist to a whitelist

    XMLWordPrintable

    Details

    • Epic Name:
      JEP-200: Switch Remoting/XStream blacklist to a whitelist
    • Similar Issues:

      Description

      Currently Remoting and XStream2 share a blacklist of classes thought to be dangerous to deserialize, due to historically reported remote code execution attacks. We should instead switch to a whitelist, plus some categorical exemptions.

        Attachments

          Issue Links

            Activity

            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Jesse Glick
            Path:
            core/src/main/java/hudson/util/XStream2.java
            core/src/main/java/jenkins/model/Jenkins.java
            core/src/main/java/jenkins/security/ClassFilterImpl.java
            core/src/main/java/jenkins/security/CustomClassFilter.java
            core/src/main/resources/jenkins/security/whitelisted-classes.txt
            pom.xml
            test/pom.xml
            test/src/test/groovy/hudson/cli/BuildCommandTest.groovy
            test/src/test/java/hudson/cli/BuildCommand2Test.java
            test/src/test/java/hudson/util/XStream2Security383Test.java
            test/src/test/java/jenkins/install/InstallUtilTest.java
            test/src/test/java/jenkins/install/SetupWizardTest.java
            test/src/test/java/jenkins/security/ClassFilterImplTest.java
            test/src/test/java/jenkins/security/CustomClassFilterTest.java
            test/src/test/java/jenkins/security/Security218CliTest.java
            test/src/test/java/jenkins/security/Security218Test.java
            test/src/test/resources/plugins/custom-class-filter.jpi
            http://jenkins-ci.org/commit/jenkins/903b4461d37170ccda49ce6637adf7cf4a261b93
            Log:
            JENKINS-47736 Switch Remoting/XStream blacklist to a whitelist.

            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: core/src/main/java/hudson/util/XStream2.java core/src/main/java/jenkins/model/Jenkins.java core/src/main/java/jenkins/security/ClassFilterImpl.java core/src/main/java/jenkins/security/CustomClassFilter.java core/src/main/resources/jenkins/security/whitelisted-classes.txt pom.xml test/pom.xml test/src/test/groovy/hudson/cli/BuildCommandTest.groovy test/src/test/java/hudson/cli/BuildCommand2Test.java test/src/test/java/hudson/util/XStream2Security383Test.java test/src/test/java/jenkins/install/InstallUtilTest.java test/src/test/java/jenkins/install/SetupWizardTest.java test/src/test/java/jenkins/security/ClassFilterImplTest.java test/src/test/java/jenkins/security/CustomClassFilterTest.java test/src/test/java/jenkins/security/Security218CliTest.java test/src/test/java/jenkins/security/Security218Test.java test/src/test/resources/plugins/custom-class-filter.jpi http://jenkins-ci.org/commit/jenkins/903b4461d37170ccda49ce6637adf7cf4a261b93 Log: JENKINS-47736 Switch Remoting/XStream blacklist to a whitelist.
            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Oleg Nenashev
            Path:
            pom.xml
            http://jenkins-ci.org/commit/jenkins/29362a5b7b94ddfe0ead38c423c54c81bfced53d
            Log:
            JENKINS-47736 - Use the new snapshot: remoting-3.16-20171228.162243-1

            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: pom.xml http://jenkins-ci.org/commit/jenkins/29362a5b7b94ddfe0ead38c423c54c81bfced53d Log: JENKINS-47736 - Use the new snapshot: remoting-3.16-20171228.162243-1
            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Oleg Nenashev
            Path:
            pom.xml
            http://jenkins-ci.org/commit/jenkins/88e756de6fe6c3333658e6d4be6aad2323a63e09
            Log:
            JENKINS-47736 - Use the released version of Remoting 3.16

            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: pom.xml http://jenkins-ci.org/commit/jenkins/88e756de6fe6c3333658e6d4be6aad2323a63e09 Log: JENKINS-47736 - Use the released version of Remoting 3.16
            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Jesse Glick
            Path:
            core/src/main/java/hudson/PluginManager.java
            core/src/main/java/hudson/util/XStream2.java
            core/src/main/java/jenkins/MasterToSlaveFileCallable.java
            core/src/main/java/jenkins/SlaveToMasterFileCallable.java
            core/src/main/java/jenkins/model/Jenkins.java
            core/src/main/java/jenkins/security/ClassFilterImpl.java
            core/src/main/java/jenkins/security/CustomClassFilter.java
            core/src/main/java/jenkins/security/MasterToSlaveCallable.java
            core/src/main/java/jenkins/security/SlaveToMasterCallable.java
            core/src/main/resources/jenkins/security/whitelisted-classes.txt
            pom.xml
            test/src/test/java/hudson/util/XStream2Security383Test.java
            test/src/test/java/jenkins/install/InstallUtilTest.java
            test/src/test/java/jenkins/install/SetupWizardTest.java
            test/src/test/java/jenkins/security/ClassFilterImplTest.java
            test/src/test/java/jenkins/security/CustomClassFilterTest.java
            test/src/test/java/jenkins/security/Security218CliTest.java
            test/src/test/java/jenkins/security/Security218Test.java
            test/src/test/resources/plugins/custom-class-filter.jpi
            http://jenkins-ci.org/commit/jenkins/cb4903c20e788f015f6210a965a2759009ff24f2
            Log:
            [JEP-200] JENKINS-47736 Merged #3120: ClassFilterImpl

            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: core/src/main/java/hudson/PluginManager.java core/src/main/java/hudson/util/XStream2.java core/src/main/java/jenkins/MasterToSlaveFileCallable.java core/src/main/java/jenkins/SlaveToMasterFileCallable.java core/src/main/java/jenkins/model/Jenkins.java core/src/main/java/jenkins/security/ClassFilterImpl.java core/src/main/java/jenkins/security/CustomClassFilter.java core/src/main/java/jenkins/security/MasterToSlaveCallable.java core/src/main/java/jenkins/security/SlaveToMasterCallable.java core/src/main/resources/jenkins/security/whitelisted-classes.txt pom.xml test/src/test/java/hudson/util/XStream2Security383Test.java test/src/test/java/jenkins/install/InstallUtilTest.java test/src/test/java/jenkins/install/SetupWizardTest.java test/src/test/java/jenkins/security/ClassFilterImplTest.java test/src/test/java/jenkins/security/CustomClassFilterTest.java test/src/test/java/jenkins/security/Security218CliTest.java test/src/test/java/jenkins/security/Security218Test.java test/src/test/resources/plugins/custom-class-filter.jpi http://jenkins-ci.org/commit/jenkins/cb4903c20e788f015f6210a965a2759009ff24f2 Log: [JEP-200] JENKINS-47736 Merged #3120: ClassFilterImpl
            Hide
            jglick Jesse Glick added a comment -

            Merged toward 2.102.

            Show
            jglick Jesse Glick added a comment - Merged toward 2.102.

              People

              • Assignee:
                jglick Jesse Glick
                Reporter:
                jglick Jesse Glick
              • Votes:
                1 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: