Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-58618

Only ignores PRs from untrusted sources "once"

    Details

    • Similar Issues:

      Description

      Note: setting to Critical as this exposes serious security issues.

      The Ignore change requests flagged as originating from an untrusted source build strategy:

      seems to only work on the first commit to a PR from an untrusted source. If a somebody with the appropriate permissions executes a Build Now on that PR, presumably because they have done a code inspection looking for nefarious use of the build and test resources, any subsequent pushes to that PR, even from untrusted sources will get automatically built, without the need for somebody to again go execute a Build Now.

      This of course means that such a PR could introduce nefarious use, without review, after having it's first commit in the PR approved and built.

      Every new commit to a PR from an untrusted source needs to be prevented from building until somebody approves it with an explicit Build Now click.  Otherwise this whole option becomes much less useful.

        Attachments

          Activity

          Hide
          bitwiseman Liam Newman added a comment -

          This is definitely looks like an issue, but I'm not sure of the source.

          We'll need to do some debugging to figure it out.

          Have you tried setting Trusted to "Nobody" as suggested here:

          https://issues.jenkins-ci.org/browse/JENKINS-53752?focusedCommentId=373461&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-373461

          From what I see that results in the correct behavior, so for truly untrusted cases the filter seems to work:

           

          Checking pull request#10
          (not from a trusted source) ‘Jenkinsfile’ found Met criteria Changes detected: PR-10-head (badd9a4f697a55c573b4d4fbabb61870e8efa4ea → e9e963e7ebfd5a54874c8962a9108930edcbb421) Loading trusted files from base branch master at bc1bf622bedeb9a04debfa2236620eb0edac6dc6 rather than e9e963e7ebfd5a54874c8962a9108930edcbb421 No automatic build triggered for PR-10-head (not from a trusted source)

           

          You could then specific users to still build for.  

          To be clear, there is a bug here and it should be fixed, but it will take some work to isolate. 

           

           

          Show
          bitwiseman Liam Newman added a comment - This is definitely looks like an issue, but I'm not sure of the source. We'll need to do some debugging to figure it out. Have you tried setting Trusted to "Nobody" as suggested here: https://issues.jenkins-ci.org/browse/JENKINS-53752?focusedCommentId=373461&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-373461 From what I see that results in the correct behavior, so for truly untrusted cases the filter seems to work:   Checking pull request #10 (not from a trusted source) ‘Jenkinsfile’ found Met criteria Changes detected: PR-10-head (badd9a4f697a55c573b4d4fbabb61870e8efa4ea → e9e963e7ebfd5a54874c8962a9108930edcbb421) Loading trusted files from base branch master at bc1bf622bedeb9a04debfa2236620eb0edac6dc6 rather than e9e963e7ebfd5a54874c8962a9108930edcbb421 No automatic build triggered for PR-10-head (not from a trusted source)   You could then specific users to still build for.   To be clear, there is a bug here and it should be fixed, but it will take some work to isolate.     
          Hide
          brianjmurrell Brian J Murrell added a comment -

          Is it really appropriate to downgrade a security-impacting issue like this to Major?

          Have you tried setting Trusted to "Nobody" as suggested here:

          That's not the behaviour we are looking for though. We want members of the organisation to be able to push PRs from their own GitHub accounts (i.e. as opposed to using branches within the organisation) and have Jenkins build those.

          Show
          brianjmurrell Brian J Murrell added a comment - Is it really appropriate to downgrade a security-impacting issue like this to Major ? Have you tried setting Trusted to "Nobody" as suggested here: That's not the behaviour we are looking for though. We want members of the organisation to be able to push PRs from their own GitHub accounts (i.e. as opposed to using branches within the organisation) and have Jenkins build those.
          Hide
          bitwiseman Liam Newman added a comment -

          Fair enough, I've returned the priority to Critical. I'm not the owner/maintainer of this plugin, just effected by it. 

          For security issues like this, you should file an issue under the Jenkins Jira "SECURITY" project. That will likely get more attention that a general functionality issue. See https://jenkins.io/security/ for details.

          Show
          bitwiseman Liam Newman added a comment - Fair enough, I've returned the priority to Critical. I'm not the owner/maintainer of this plugin, just effected by it.  For security issues like this, you should file an issue under the Jenkins Jira "SECURITY" project. That will likely get more attention that a general functionality issue. See  https://jenkins.io/security/  for details.

            People

            • Assignee:
              Unassigned
              Reporter:
              brianjmurrell Brian J Murrell
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated: