Skip to content

Commit 3a8abe1

Browse files
jglickdaniel-beck
jglick
authored and
daniel-beck
committed
[SECURITY-704]
1 parent 57a30b0 commit 3a8abe1

File tree

4 files changed

+106
-47
lines changed

4 files changed

+106
-47
lines changed

‎pom.xml

Lines changed: 55 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
<parent>
3030
<groupId>org.jenkins-ci.plugins</groupId>
3131
<artifactId>plugin</artifactId>
32-
<version>2.21</version>
32+
<version>3.17</version>
3333
<relativePath />
3434
</parent>
3535

@@ -55,10 +55,6 @@
5555
</developer>
5656
</developers>
5757

58-
<prerequisites>
59-
<maven>2.2.1</maven>
60-
</prerequisites>
61-
6258
<scm>
6359
<connection>scm:git:git://github.com/jenkinsci/ssh-agent-plugin.git</connection>
6460
<developerConnection>scm:git:[email protected]:jenkinsci/ssh-agent-plugin.git</developerConnection>
@@ -67,9 +63,9 @@
6763
</scm>
6864

6965
<properties>
70-
<jenkins.version>1.609.3</jenkins.version>
71-
<java.level>7</java.level> <!-- sshd-core is 7+ -->
72-
<workflow-jenkins-plugin.version>1.14.2</workflow-jenkins-plugin.version>
66+
<jenkins.version>2.60.3</jenkins.version>
67+
<java.level>8</java.level>
68+
<workflow-support-plugin.version>2.18</workflow-support-plugin.version>
7369
</properties>
7470

7571
<repositories>
@@ -97,18 +93,6 @@
9793
<artifactId>tomcat-apr</artifactId>
9894
<version>5.5.23</version>
9995
</dependency>
100-
<dependency>
101-
<groupId>org.slf4j</groupId>
102-
<artifactId>slf4j-api</artifactId>
103-
<version>1.7.7</version>
104-
<scope>provided</scope>
105-
</dependency>
106-
<dependency>
107-
<groupId>org.slf4j</groupId>
108-
<artifactId>slf4j-jdk14</artifactId>
109-
<version>1.7.7</version>
110-
<scope>provided</scope>
111-
</dependency>
11296
<dependency>
11397
<groupId>com.cloudbees.util</groupId>
11498
<artifactId>jnr-unixsocket-nodep</artifactId>
@@ -117,72 +101,103 @@
117101
<dependency>
118102
<groupId>org.jenkins-ci.plugins.workflow</groupId>
119103
<artifactId>workflow-step-api</artifactId>
120-
<version>${workflow-jenkins-plugin.version}</version>
104+
<version>2.16</version>
121105
</dependency>
122106

123107
<!-- plugin dependencies -->
124108
<dependency>
125109
<groupId>org.jenkins-ci.plugins</groupId>
126110
<artifactId>credentials</artifactId>
127-
<version>2.1.1</version>
111+
<version>2.1.17</version>
128112
</dependency>
129113
<dependency>
130114
<groupId>org.jenkins-ci.plugins</groupId>
131115
<artifactId>ssh-credentials</artifactId>
132-
<version>1.11</version>
116+
<version>1.14</version>
133117
</dependency>
134118
<dependency>
135119
<groupId>org.jenkins-ci.plugins</groupId>
136120
<artifactId>bouncycastle-api</artifactId>
137-
<version>1.0.2</version>
121+
<version>2.16.3</version>
138122
</dependency>
139123
<!-- jenkins dependencies -->
140124
<!-- test dependencies -->
125+
<dependency>
126+
<groupId>org.jenkins-ci.plugins.workflow</groupId>
127+
<artifactId>workflow-api</artifactId>
128+
<version>2.27</version>
129+
<scope>test</scope>
130+
</dependency>
141131
<dependency>
142132
<groupId>org.jenkins-ci.plugins.workflow</groupId>
143133
<artifactId>workflow-job</artifactId>
144-
<version>${workflow-jenkins-plugin.version}</version>
134+
<version>2.12.2</version>
145135
<scope>test</scope>
146136
</dependency>
147137
<dependency>
148138
<groupId>org.jenkins-ci.plugins.workflow</groupId>
149139
<artifactId>workflow-basic-steps</artifactId>
150-
<version>${workflow-jenkins-plugin.version}</version>
140+
<version>2.8</version>
151141
<scope>test</scope>
152142
</dependency>
153143
<dependency>
154144
<groupId>org.jenkins-ci.plugins.workflow</groupId>
155145
<artifactId>workflow-durable-task-step</artifactId>
156-
<version>${workflow-jenkins-plugin.version}</version>
146+
<version>2.19</version>
157147
<scope>test</scope>
158148
</dependency>
159149
<dependency>
160150
<groupId>org.jenkins-ci.plugins.workflow</groupId>
161151
<artifactId>workflow-cps</artifactId>
162-
<version>${workflow-jenkins-plugin.version}</version>
152+
<version>2.45</version>
163153
<scope>test</scope>
164154
</dependency>
165155
<dependency>
166156
<groupId>org.jenkins-ci.plugins.workflow</groupId>
167157
<artifactId>workflow-support</artifactId>
168-
<version>${workflow-jenkins-plugin.version}</version>
158+
<version>${workflow-support-plugin.version}</version>
159+
<scope>test</scope>
160+
</dependency>
161+
<dependency>
162+
<groupId>org.jenkins-ci.plugins.workflow</groupId>
163+
<artifactId>workflow-support</artifactId>
164+
<version>${workflow-support-plugin.version}</version>
169165
<classifier>tests</classifier>
170166
<scope>test</scope>
171167
</dependency>
172-
<dependency> <!-- TODO Jenkins sshd (1.6) depends on sshd-core 0.8, which is incompatible with 1.0 -->
173-
<groupId>org.jenkins-ci.main</groupId>
174-
<artifactId>jenkins-war</artifactId>
175-
<version>${jenkins.version}</version>
176-
<classifier>war-for-test</classifier>
168+
<dependency>
169+
<groupId>org.jenkins-ci.plugins</groupId>
170+
<artifactId>docker-workflow</artifactId>
171+
<version>1.17</version>
177172
<scope>test</scope>
178-
<exclusions>
179-
<exclusion>
180-
<groupId>org.jenkins-ci.modules</groupId>
181-
<artifactId>sshd</artifactId>
182-
</exclusion>
183-
</exclusions>
184173
</dependency>
185174
</dependencies>
175+
<dependencyManagement>
176+
<dependencies>
177+
<dependency>
178+
<groupId>org.jenkins-ci.plugins</groupId>
179+
<artifactId>structs</artifactId>
180+
<version>1.14</version>
181+
</dependency>
182+
<dependency>
183+
<groupId>org.jenkins-ci</groupId>
184+
<artifactId>symbol-annotation</artifactId>
185+
<version>1.14</version>
186+
</dependency>
187+
<dependency>
188+
<groupId>org.jenkins-ci.plugins</groupId>
189+
<artifactId>script-security</artifactId>
190+
<version>1.44</version>
191+
<scope>test</scope>
192+
</dependency>
193+
<dependency>
194+
<groupId>org.jenkins-ci.plugins</groupId>
195+
<artifactId>scm-api</artifactId>
196+
<version>2.2.7</version>
197+
<scope>test</scope>
198+
</dependency>
199+
</dependencies>
200+
</dependencyManagement>
186201

187202
<build>
188203
<plugins>

‎src/main/java/com/cloudbees/jenkins/plugins/sshagent/SSHAgentStepExecution.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ public boolean start() throws Exception {
6363
initRemoteAgent();
6464
context.newBodyInvoker().
6565
withContext(EnvironmentExpander.merge(getContext().get(EnvironmentExpander.class), new ExpanderImpl(this))).
66-
withCallback(new Callback(this)).withDisplayName(null).start();
66+
withCallback(new Callback(this)).start();
6767
return false;
6868
}
6969

‎src/main/java/com/cloudbees/jenkins/plugins/sshagent/exec/ExecRemoteAgent.java

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,11 @@ public void addIdentity(String privateKey, final String passphrase, String comme
105105
env.put("DISPLAY", ":0"); // just to force using SSH_ASKPASS
106106
env.put("SSH_ASKPASS", askpass.getRemote());
107107
}
108-
if (launcher.launch().cmds("ssh-add", keyFile.getRemote()).envs(env).stdout(listener).start().joinWithTimeout(1, TimeUnit.MINUTES, listener) != 0) {
108+
109+
// as the next command is in quiet mode, we just add a message to the log
110+
launcher.getListener().getLogger().println("Running ssh-add (command line suppressed)");
111+
112+
if (launcher.launch().quiet(true).cmds("ssh-add", keyFile.getRemote()).envs(env).stdout(listener).start().joinWithTimeout(1, TimeUnit.MINUTES, listener) != 0) {
109113
throw new AbortException("Failed to run ssh-add");
110114
}
111115
} finally {

‎src/test/java/com/cloudbees/jenkins/plugins/sshagent/SSHAgentStepWorkflowTest.java

Lines changed: 45 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@
55
import com.cloudbees.plugins.credentials.CredentialsProvider;
66
import com.cloudbees.plugins.credentials.CredentialsScope;
77
import com.cloudbees.plugins.credentials.SystemCredentialsProvider;
8-
import com.cloudbees.plugins.credentials.domains.Domain;
9-
import hudson.Util;
8+
import hudson.Launcher;
109
import hudson.model.Fingerprint;
11-
import hudson.util.Secret;
10+
import hudson.util.StreamTaskListener;
11+
import java.io.IOException;
1212
import org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition;
1313
import org.jenkinsci.plugins.workflow.cps.CpsFlowExecution;
1414
import org.jenkinsci.plugins.workflow.job.WorkflowJob;
@@ -26,14 +26,17 @@
2626
import java.util.ArrayList;
2727
import java.util.List;
2828
import java.util.Scanner;
29-
import java.util.regex.Matcher;
29+
import java.util.concurrent.TimeUnit;
3030
import java.util.regex.Pattern;
3131

32-
import static org.hamcrest.CoreMatchers.is;
32+
import static org.hamcrest.Matchers.is;
3333
import static org.hamcrest.core.IsCollectionContaining.hasItem;
3434
import static org.hamcrest.core.IsNull.notNullValue;
3535
import static org.hamcrest.core.IsNull.nullValue;
36+
import org.jenkinsci.plugins.docker.commons.tools.DockerTool;
37+
import org.jenkinsci.plugins.docker.workflow.client.DockerClient;
3638
import static org.junit.Assert.*;
39+
import static org.junit.Assume.*;
3740

3841
public class SSHAgentStepWorkflowTest extends SSHAgentBase {
3942

@@ -191,4 +194,41 @@ public void evaluate() throws Throwable {
191194
}
192195
});
193196
}
197+
198+
@Issue("SECURITY-704")
199+
@Test
200+
public void sshAgentDocker() throws Exception {
201+
story.then(r -> {
202+
// From org.jenkinsci.plugins.docker.workflow.DockerTestUtil:
203+
Launcher.LocalLauncher localLauncher = new Launcher.LocalLauncher(StreamTaskListener.NULL);
204+
try {
205+
assumeThat("Docker working", localLauncher.launch().cmds(DockerTool.getExecutable(null, null, null, null), "ps").start().joinWithTimeout(DockerClient.CLIENT_TIMEOUT, TimeUnit.SECONDS, localLauncher.getListener()), is(0));
206+
} catch (IOException x) {
207+
assumeNoException("have Docker installed", x);
208+
}
209+
210+
List<String> credentialIds = new ArrayList<String>();
211+
credentialIds.add(CREDENTIAL_ID);
212+
213+
SSHUserPrivateKey key = new BasicSSHUserPrivateKey(CredentialsScope.GLOBAL, credentialIds.get(0), "x",
214+
new BasicSSHUserPrivateKey.DirectEntryPrivateKeySource(getPrivateKey()), "cloudbees", "test");
215+
SystemCredentialsProvider.getInstance().getCredentials().add(key);
216+
SystemCredentialsProvider.getInstance().save();
217+
218+
WorkflowJob job = r.createProject(WorkflowJob.class, "sshAgentDocker");
219+
job.setDefinition(new CpsFlowDefinition(""
220+
+ "node('" + r.createSlave().getNodeName() + "') {\n"
221+
+ " withDockerContainer('kroniak/ssh-client') {\n"
222+
+ " sh 'ssh-agent -k || :'\n"
223+
+ " sshagent(credentials: ['" + CREDENTIAL_ID + "']) {\n"
224+
+ " sh 'env'\n"
225+
+ " }\n"
226+
+ " }\n"
227+
+ "}\n", true)
228+
);
229+
WorkflowRun b = r.buildAndAssertSuccess(job);
230+
r.assertLogNotContains("cloudbees", b);
231+
});
232+
}
233+
194234
}

0 commit comments

Comments
 (0)