|
26 | 26 |
|
27 | 27 | import hudson.Functions; |
28 | 28 | import hudson.model.Result; |
29 | | -import hudson.scm.SubversionSCM; |
30 | | -import java.io.File; |
31 | | -import java.nio.charset.StandardCharsets; |
32 | 29 | import jenkins.branch.BranchSource; |
33 | 30 | import jenkins.plugins.git.GitSampleRepoRule; |
34 | 31 | import jenkins.plugins.git.GitStep; |
|
47 | 44 | import java.nio.file.Files; |
48 | 45 | import java.nio.file.Path; |
49 | 46 | import java.nio.file.Paths; |
50 | | -import jenkins.plugins.git.GitSCMSource; |
51 | | -import jenkins.scm.impl.subversion.SubversionSCMSource; |
52 | | -import jenkins.scm.impl.subversion.SubversionSampleRepoRule; |
53 | | -import org.apache.commons.io.FileUtils; |
54 | | -import org.junit.Ignore; |
55 | 47 | import org.jvnet.hudson.test.FlagRule; |
56 | 48 |
|
57 | | -import static org.hamcrest.MatcherAssert.assertThat; |
58 | | -import static org.hamcrest.Matchers.equalTo; |
59 | | -import static org.hamcrest.Matchers.not; |
60 | | -import static org.hamcrest.io.FileMatchers.anExistingFile; |
61 | 49 | import static org.junit.Assume.assumeFalse; |
62 | 50 |
|
63 | 51 | public class ReadTrustedStepTest { |
64 | 52 |
|
65 | 53 | @ClassRule public static BuildWatcher buildWatcher = new BuildWatcher(); |
66 | 54 | @Rule public JenkinsRule r = new JenkinsRule(); |
67 | 55 | @Rule public GitSampleRepoRule sampleRepo = new GitSampleRepoRule(); |
68 | | - @Rule public SubversionSampleRepoRule sampleRepoSvn = new SubversionSampleRepoRule(); |
69 | 56 | @Rule public FlagRule<Boolean> heavyweightCheckoutFlag = new FlagRule<>(() -> SCMBinder.USE_HEAVYWEIGHT_CHECKOUT, v -> { SCMBinder.USE_HEAVYWEIGHT_CHECKOUT = v; }); |
70 | 57 |
|
71 | 58 | @Test public void smokes() throws Exception { |
@@ -305,76 +292,4 @@ public void symlinksInNonMultibranchCannotEscapeWorkspaceContextViaReadTrusted() |
305 | 292 | r.assertLogContains("master.key references a file that is not inside " + r.jenkins.getWorkspaceFor(p), run); |
306 | 293 | } |
307 | 294 |
|
308 | | - @Ignore("There are two checkouts, one from CpsScmFlowDefinition via SCMBinder and one from ReadTrustedStep. Fixing the former requires an updated version of workflow-cps.") |
309 | | - @Issue("SECURITY-2463") |
310 | | - @Test public void multibranchCheckoutDirectoriesAreNotReusedByDifferentScms() throws Exception { |
311 | | - SCMBinder.USE_HEAVYWEIGHT_CHECKOUT = true; |
312 | | - assumeFalse(Functions.isWindows()); // Checkout hook is not cross-platform. |
313 | | - sampleRepo.init(); |
314 | | - sampleRepo.git("checkout", "-b", "trunk"); // So we end up using the same project for both SCMs. |
315 | | - sampleRepo.write("Jenkinsfile", "echo('git library'); readTrusted('Jenkinsfile')"); |
316 | | - sampleRepo.git("add", "Jenkinsfile"); |
317 | | - sampleRepo.git("commit", "--message=init"); |
318 | | - sampleRepoSvn.init(); |
319 | | - sampleRepoSvn.write("Jenkinsfile", "echo('svn library'); readTrusted('Jenkinsfile')"); |
320 | | - // Copy .git folder from the Git repo into the SVN repo as data. |
321 | | - File gitDirInSvnRepo = new File(sampleRepoSvn.wc(), ".git"); |
322 | | - FileUtils.copyDirectory(new File(sampleRepo.getRoot(), ".git"), gitDirInSvnRepo); |
323 | | - String jenkinsRootDir = r.jenkins.getRootDir().toString(); |
324 | | - // Add a Git post-checkout hook to the .git folder in the SVN repo. |
325 | | - Path postCheckoutHook = gitDirInSvnRepo.toPath().resolve("hooks/post-checkout"); |
326 | | - // Always create hooks directory for compatibility with https://github.com/jenkinsci/git-plugin/pull/1207. |
327 | | - Files.createDirectories(postCheckoutHook.getParent()); |
328 | | - Files.write(postCheckoutHook, ("#!/bin/sh\ntouch '" + jenkinsRootDir + "/hook-executed'\n").getBytes(StandardCharsets.UTF_8)); |
329 | | - sampleRepoSvn.svnkit("add", sampleRepoSvn.wc() + "/Jenkinsfile"); |
330 | | - sampleRepoSvn.svnkit("add", sampleRepoSvn.wc() + "/.git"); |
331 | | - sampleRepoSvn.svnkit("propset", "svn:executable", "ON", sampleRepoSvn.wc() + "/.git/hooks/post-checkout"); |
332 | | - sampleRepoSvn.svnkit("commit", "--message=init", sampleRepoSvn.wc()); |
333 | | - // Run a build using the SVN repo. |
334 | | - WorkflowMultiBranchProject mp = r.jenkins.createProject(WorkflowMultiBranchProject.class, "p"); |
335 | | - mp.getSourcesList().add(new BranchSource(new SubversionSCMSource("", sampleRepoSvn.prjUrl()))); |
336 | | - WorkflowJob p = WorkflowMultiBranchProjectTest.scheduleAndFindBranchProject(mp, "trunk"); |
337 | | - r.waitUntilNoActivity(); |
338 | | - // Run a build using the Git repo. It should be checked out to a different directory than the SVN repo. |
339 | | - mp.getSourcesList().clear(); |
340 | | - mp.getSourcesList().add(new BranchSource(new GitSCMSource("", sampleRepo.toString(), "", "*", "", false))); |
341 | | - WorkflowMultiBranchProjectTest.scheduleAndFindBranchProject(mp, "trunk"); |
342 | | - r.waitUntilNoActivity(); |
343 | | - assertThat(p.getLastBuild().getNumber(), equalTo(2)); |
344 | | - assertThat(new File(r.jenkins.getRootDir(), "hook-executed"), not(anExistingFile())); |
345 | | - } |
346 | | - |
347 | | - @Ignore("There are two checkouts, one from CpsScmFlowDefinition and one from ReadTrustedStep. Fixing the former requires an updated version of workflow-cps.") |
348 | | - @Issue("SECURITY-2463") |
349 | | - @Test public void checkoutDirectoriesAreNotReusedByDifferentScms() throws Exception { |
350 | | - SCMBinder.USE_HEAVYWEIGHT_CHECKOUT = true; |
351 | | - assumeFalse(Functions.isWindows()); // Checkout hook is not cross-platform. |
352 | | - sampleRepo.init(); |
353 | | - sampleRepo.write("Jenkinsfile", "echo('git library'); readTrusted('Jenkinsfile')"); |
354 | | - sampleRepo.git("add", "Jenkinsfile"); |
355 | | - sampleRepo.git("commit", "--message=init"); |
356 | | - sampleRepoSvn.init(); |
357 | | - sampleRepoSvn.write("Jenkinsfile", "echo('subversion library'); readTrusted('Jenkinsfile')"); |
358 | | - // Copy .git folder from the Git repo into the SVN repo as data. |
359 | | - File gitDirInSvnRepo = new File(sampleRepoSvn.wc(), ".git"); |
360 | | - FileUtils.copyDirectory(new File(sampleRepo.getRoot(), ".git"), gitDirInSvnRepo); |
361 | | - String jenkinsRootDir = r.jenkins.getRootDir().toString(); |
362 | | - // Add a Git post-checkout hook to the .git folder in the SVN repo. |
363 | | - Path postCheckoutHook = gitDirInSvnRepo.toPath().resolve("hooks/post-checkout"); |
364 | | - // Always create hooks directory for compatibility with https://github.com/jenkinsci/git-plugin/pull/1207. |
365 | | - Files.createDirectories(postCheckoutHook.getParent()); |
366 | | - Files.write(postCheckoutHook, ("#!/bin/sh\ntouch '" + jenkinsRootDir + "/hook-executed'\n").getBytes(StandardCharsets.UTF_8)); |
367 | | - sampleRepoSvn.svnkit("add", sampleRepoSvn.wc() + "/Jenkinsfile"); |
368 | | - sampleRepoSvn.svnkit("add", sampleRepoSvn.wc() + "/.git"); |
369 | | - sampleRepoSvn.svnkit("propset", "svn:executable", "ON", sampleRepoSvn.wc() + "/.git/hooks/post-checkout"); |
370 | | - sampleRepoSvn.svnkit("commit", "--message=init", sampleRepoSvn.wc()); |
371 | | - // Run a build using the SVN repo. |
372 | | - WorkflowJob p = r.createProject(WorkflowJob.class); |
373 | | - p.setDefinition(new CpsScmFlowDefinition(new SubversionSCM(sampleRepoSvn.trunkUrl()), "Jenkinsfile")); |
374 | | - r.buildAndAssertSuccess(p); |
375 | | - // Run a build using the Git repo. It should be checked out to a different directory than the SVN repo. |
376 | | - p.setDefinition(new CpsScmFlowDefinition(new GitStep(sampleRepo.toString()).createSCM(), "Jenkinsfile")); |
377 | | - WorkflowRun b2 = r.buildAndAssertSuccess(p); |
378 | | - assertThat(new File(r.jenkins.getRootDir(), "hook-executed"), not(anExistingFile())); |
379 | | - } |
380 | 295 | } |
0 commit comments