From e8237a803012bae7773d8bd10fe02e21892be3fe Mon Sep 17 00:00:00 2001 From: Tomas Bjerre Date: Fri, 13 Sep 2019 20:58:42 +0200 Subject: [PATCH] Removing raw API Token and forcing credential In a pipeline you can no longer do `apiToken: 'asd'` and will have to do `apiTokenCredentialsId: 'id'`. SECURITY-1577 --- README.md | 3 -- pom.xml | 4 +-- sandbox/gitlab.com.testpipeline.jenkinsfile | 3 -- ...ViolationsToGitLabGlobalConfiguration.java | 31 ++++++------------- .../config/ViolationsToGitLabConfig.java | 30 +++++++----------- .../ViolationsToGitLabConfigHelper.java | 3 -- .../jvctgl/perform/JvctglPerformer.java | 21 ++++--------- .../config.jelly | 14 ++------- .../ViolationsToGitLabConfig/config.jelly | 15 ++------- 9 files changed, 35 insertions(+), 89 deletions(-) diff --git a/README.md b/README.md index 51edc4e..258a851 100644 --- a/README.md +++ b/README.md @@ -292,7 +292,6 @@ job('GitLab_MR_Builder') { enableLogging(true) - apiToken("") apiTokenCredentialsId("gitlabtoken") apiTokenPrivate(true) authMethodHeader(true) @@ -485,8 +484,6 @@ node { proxyUser: '', proxyPassword: '', - // Specify one of these - apiToken: '6xRcmSzPzzEXeS2qqr7R', apiTokenCredentialsId: 'id', apiTokenPrivate: true, diff --git a/pom.xml b/pom.xml index 0879409..9d24783 100644 --- a/pom.xml +++ b/pom.xml @@ -13,9 +13,9 @@ 2.1 false true - 1.20 + 1.21 1.78 - 1.97 + 1.101 1.60 2.9 diff --git a/sandbox/gitlab.com.testpipeline.jenkinsfile b/sandbox/gitlab.com.testpipeline.jenkinsfile index 5b7b6a9..33efc12 100644 --- a/sandbox/gitlab.com.testpipeline.jenkinsfile +++ b/sandbox/gitlab.com.testpipeline.jenkinsfile @@ -26,9 +26,6 @@ node { commentOnlyChangedFiles: true, createCommentWithAllSingleFileComments: true, minSeverity: 'INFO', - useApiToken: true, - apiToken: 'asdasdasdasd', - useApiTokenCredentials: false, apiTokenCredentialsId: 'id', apiTokenPrivate: true, authMethodHeader: true, diff --git a/src/main/java/org/jenkinsci/plugins/jvctgl/ViolationsToGitLabGlobalConfiguration.java b/src/main/java/org/jenkinsci/plugins/jvctgl/ViolationsToGitLabGlobalConfiguration.java index 221099b..4058406 100644 --- a/src/main/java/org/jenkinsci/plugins/jvctgl/ViolationsToGitLabGlobalConfiguration.java +++ b/src/main/java/org/jenkinsci/plugins/jvctgl/ViolationsToGitLabGlobalConfiguration.java @@ -35,7 +35,6 @@ public static ViolationsToGitLabGlobalConfiguration get() { private boolean ignoreCertificateErrors; - private String apiToken; private boolean apiTokenPrivate; private boolean authMethodHeader; private String apiTokenCredentialsId; @@ -63,16 +62,18 @@ public ListBoxModel doFillMinSeverityItems() { @SuppressWarnings("unused") // Used by stapler public ListBoxModel doFillApiTokenCredentialsIdItems( - @AncestorInPath Item item, - @QueryParameter String apiTokenCredentialsId, - @QueryParameter String gitLabUrl) { + @AncestorInPath final Item item, + @QueryParameter final String apiTokenCredentialsId, + @QueryParameter final String gitLabUrl) { return CredentialsHelper.doFillApiTokenCredentialsIdItems( item, apiTokenCredentialsId, gitLabUrl); } @SuppressWarnings("unused") // Used by stapler public FormValidation doCheckApiTokenCredentialsId( - @AncestorInPath Item item, @QueryParameter String value, @QueryParameter String gitLabUrl) { + @AncestorInPath final Item item, + @QueryParameter final String value, + @QueryParameter final String gitLabUrl) { return CredentialsHelper.doCheckApiTokenCredentialsId(item, value, gitLabUrl); } @@ -89,13 +90,11 @@ public void setIgnoreCertificateErrors(final boolean ignoreCertificateErrors) { this.ignoreCertificateErrors = ignoreCertificateErrors; } - public String getApiToken() { - return apiToken; - } - @DataBoundSetter + @Deprecated public void setApiToken(final String apiToken) { - this.apiToken = apiToken; + throw new RuntimeException( + "Setting raw API token is removed, set the apiTokenCredentialsId with a string credential instead!"); } public String getApiTokenCredentialsId() { @@ -147,7 +146,6 @@ public void setAuthMethodHeader(final boolean authMethodHeader) { public int hashCode() { final int prime = 31; int result = 1; - result = prime * result + (apiToken == null ? 0 : apiToken.hashCode()); result = prime * result + (apiTokenCredentialsId == null ? 0 : apiTokenCredentialsId.hashCode()); result = prime * result + (apiTokenPrivate ? 1231 : 1237); @@ -159,7 +157,7 @@ public int hashCode() { } @Override - public boolean equals(Object obj) { + public boolean equals(final Object obj) { if (this == obj) { return true; } @@ -170,13 +168,6 @@ public boolean equals(Object obj) { return false; } final ViolationsToGitLabGlobalConfiguration other = (ViolationsToGitLabGlobalConfiguration) obj; - if (apiToken == null) { - if (other.apiToken != null) { - return false; - } - } else if (!apiToken.equals(other.apiToken)) { - return false; - } if (apiTokenCredentialsId == null) { if (other.apiTokenCredentialsId != null) { return false; @@ -212,8 +203,6 @@ public String toString() { + gitLabUrl + ", ignoreCertificateErrors=" + ignoreCertificateErrors - + ", apiToken=" - + apiToken + ", apiTokenPrivate=" + apiTokenPrivate + ", authMethodHeader=" diff --git a/src/main/java/org/jenkinsci/plugins/jvctgl/config/ViolationsToGitLabConfig.java b/src/main/java/org/jenkinsci/plugins/jvctgl/config/ViolationsToGitLabConfig.java index 22f915a..3bb761f 100644 --- a/src/main/java/org/jenkinsci/plugins/jvctgl/config/ViolationsToGitLabConfig.java +++ b/src/main/java/org/jenkinsci/plugins/jvctgl/config/ViolationsToGitLabConfig.java @@ -33,7 +33,6 @@ public class ViolationsToGitLabConfig extends AbstractDescribableImpl violationConfigs; private String gitLabUrl; - private String apiToken; private String projectId; private String mergeRequestIid; @Deprecated private transient String mergeRequestId; @@ -53,7 +52,10 @@ public class ViolationsToGitLabConfig extends AbstractDescribableImpl apiTokenCredentials, + final String apiToken, final File workspace, final TaskListener listener) throws MalformedURLException { @@ -99,14 +98,6 @@ public static void doPerform( } } - String apiToken = config.getApiToken(); - if (apiTokenCredentials.isPresent()) { - apiToken = apiTokenCredentials.get().getSecret().getPlainText(); - } - if (isNullOrEmpty(apiToken)) { - throw new IllegalStateException("No credentials found!"); - } - final String hostUrl = config.getGitLabUrl(); final String projectId = config.getProjectId(); final String mergeRequestIid = config.getMergeRequestIid(); @@ -181,8 +172,6 @@ static ViolationsToGitLabConfig expand( expanded.setProjectId(environment.expand(config.getProjectId())); expanded.setMergeRequestIid(environment.expand(config.getMergeRequestIid())); - expanded.setApiToken(config.getApiToken()); - expanded.setApiTokenCredentialsId(config.getApiTokenCredentialsId()); expanded.setAuthMethodHeader(config.getAuthMethodHeader()); @@ -259,7 +248,11 @@ public Void invoke(final File workspace, final VirtualChannel channel) throws IOException, InterruptedException { setupFindBugsMessages(); listener.getLogger().println("Workspace: " + workspace.getAbsolutePath()); - doPerform(configExpanded, apiTokenCredentials, workspace, listener); + doPerform( + configExpanded, + apiTokenCredentials.get().getSecret().getPlainText(), + workspace, + listener); return null; } }); @@ -279,8 +272,6 @@ private static void logConfiguration( logger.println(FIELD_PROJECTID + ": " + config.getProjectId()); logger.println(FIELD_MERGEREQUESTIID + ": " + config.getMergeRequestIid()); - logger.println(FIELD_APITOKEN + ": " + !isNullOrEmpty(config.getApiToken())); - logger.println( FIELD_APITOKENCREDENTIALSID + ": " + !isNullOrEmpty(config.getApiTokenCredentialsId())); logger.println(FIELD_IGNORECERTIFICATEERRORS + ": " + config.getIgnoreCertificateErrors()); diff --git a/src/main/resources/org/jenkinsci/plugins/jvctgl/ViolationsToGitLabGlobalConfiguration/config.jelly b/src/main/resources/org/jenkinsci/plugins/jvctgl/ViolationsToGitLabGlobalConfiguration/config.jelly index fdd4c32..60a779a 100644 --- a/src/main/resources/org/jenkinsci/plugins/jvctgl/ViolationsToGitLabGlobalConfiguration/config.jelly +++ b/src/main/resources/org/jenkinsci/plugins/jvctgl/ViolationsToGitLabGlobalConfiguration/config.jelly @@ -9,17 +9,9 @@ xmlns:c="/lib/credentials"> - - - - - - - - - - - + + + diff --git a/src/main/resources/org/jenkinsci/plugins/jvctgl/config/ViolationsToGitLabConfig/config.jelly b/src/main/resources/org/jenkinsci/plugins/jvctgl/config/ViolationsToGitLabConfig/config.jelly index d184c5d..f6874f4 100644 --- a/src/main/resources/org/jenkinsci/plugins/jvctgl/config/ViolationsToGitLabConfig/config.jelly +++ b/src/main/resources/org/jenkinsci/plugins/jvctgl/config/ViolationsToGitLabConfig/config.jelly @@ -8,23 +8,12 @@ xmlns:t="/lib/hudson" xmlns:c="/lib/credentials"> - - + Will default to global config. - - - - - - - - Will default to global config. - - - +