JENKINS-43637 Secures groovy script execution

[dheid]

Fixes the arbitrary code execution vulnerability by using SecureGroovyScript (https://issues.jenkins-ci.org/browse/JENKINS-43637)

[dheid]

Also I volunteer in maintaining this plugin, if you agree. You'll find the discussion in the developer mailing list here: https://groups.google.com/d/msg/jenkinsci-dev/WNNUJA1PYIg/8O8q29MEBQAJ

[dheid]

Since I removed the PostBuildScriptListener, this pull request also fixes JENKINS-31041

[dheid]

Also fixes JENKINS-19873

[patrickpierson]

I vote @dheid gets approved as maintainer. He seems to be the only one working on this.

[dheid]

Thx, Patrick!Am 02.11.2017 3:20 nachm. schrieb Patrick Pierson <notifications@github.com>:I vote @dheid gets approved as maintainer. He seems to be the only one working on this. —You are receiving this because you were mentioned.Reply to this email directly, view it on GitHub, or mute the thread.

[kgreulich]

Would be great, if @dheid would be approved as maintainer. I use this plugin too.

[patrickpierson]

@dheid looks like the wait time is at least 2 weeks

We typically wait for about 2 weeks in normal work periods before proceeding, so please be patient. Hence, if you can prove the existing maintainer already agrees and you explicitly asked about taking over (e.g. in a PR discussion), the process can be fast-looped.

That being said it this should be an exception because the last commit was on Jan 6, 2015 and now this plugin is vulnerable.

@gboissinot mind just agreeing that @dheid can take over?

[daniel-beck]

@gboissinot informed me a while back that all his plugins are to be considered abandoned, so that's not a blocker. We just suck at handling emails.

@dheid Please open a PR to https://github.com/jenkins-infra/repository-permissions-updater/ (the README explains what's needed) and mention that you need Git commit access as well (if applicable) and/or that you want to take over as maintainer (if applicable).

[dheid]

Thank you all! Here is the pull request:

jenkins-infra/repository-permissions-updater#492

[daniel-beck]

This should declare a compatibility warning to make existing users (hopefully) read the changelog:
https://wiki.jenkins-ci.org/display/JENKINS/Marking+a+new+plugin+version+as+incompatible+with+older+versions

[dheid]

Thanks for the hint. I added the compatiblity warning: 871b35a

[scpeters]

Thanks for fixing this! I saw that you made a new release, but the plugin page says "Distribution of This Plugin Has Been Suspended". I'll try to be patient, but I don't know what the next steps are for allowing people to upgrade.

[scpeters]

Ah, I think this is it: jenkins-infra/update-center2#169

[dheid]

Correct. I'm trying to remove the plugin from the blacklist. The Groovy script security mechanism is now included.

[vijaytripathi]

@dheid is this plugin still blacklisted, can we start using this plugin soon. On Jenkins page I see
"Distribution of This Plugin Has Been Suspended"

[dheid]

Hi Vijay! As soon as my pull request will be merged by @daniel-beck, the blacklisting will be removed: https://github.com/jenkins-infra/backend-update-center2/pull/169Am 11.11.2017 7:45 nachm. schrieb Vijay Tripathi <notifications@github.com>:@dheid is this plugin still blacklisted, can we start using this plugin soon. On Jenkins page I see "Distribution of This Plugin Has Been Suspended" —You are receiving this because you were mentioned.Reply to this email directly, view it on GitHub, or mute the thread.

[vijaytripathi]

Thanks Daniel , waiting for this PR to be merged. @daniel-beck
jenkins-infra/update-center2#169

[scpeters]

Looks like jenkins-infra/update-center2#169 has been merged, but I still see Distribution of This Plugin Has Been Suspended. I'm not sure how frequently they update based on changes like this.

[dheid]

@scpeters It works for my Jenkins server now. Would you please retry it?

[dheid]

@scpeters Oh, you're talking about the Wiki page. Good question. I think I must do a little research on how to disable the warning on these autogenerated pages.

[dheid]

@scpeters Looks good now: https://wiki.jenkins.io/display/JENKINS/PostBuildScript+Plugin

[daniel-beck]

@scpeters @dheid The wiki is heavily cached. Add query parameters to bypass the cache.