Branch: refs/heads/Deepomatic-better-github-username-check
Home: https://github.com/jenkinsci/ghprb-plugin
Commit: 5453f8e1f63f3d3f0685a988a02345fb46d32465
https://github.com/jenkinsci/ghprb-plugin/commit/5453f8e1f63f3d3f0685a988a02345fb46d32465
Author: Thomas Riccardi <[email protected]>
Date: 2017-11-25 (Sat, 25 Nov 2017)
Changed paths:
M src/main/java/org/jenkinsci/plugins/ghprb/GhprbTrigger.java
Log Message:
-----------
Fix catastrophic backtracking regex match
`adminlistPattern` has exponential backtracking when an invalid character is
encountered,
this leads to
`/job/<name>/descriptorByName/org.jenkinsci.plugins.ghprb.GhprbTrigger/checkAdminlist`
requests never returning, and leaking a java thread working at 100% CPU.
So each load of `/job/<name>/configure` adds +100% CPU to the jenkins
process, at least when the admin list is configured globally.
This is a DoS security risk, although it requires configuration rights
for the attacker.
There is no timeout in the regex, nor at the HTTP level (possibly not
possible).
Fixed the issue using possessive quantifiers.
The github usernames rules are:
- Github username may only contain alphanumeric characters or hyphens.
- Github username cannot have multiple consecutive hyphens.
- Github username cannot begin or end with a hyphen.
- Maximum is 39 characters. (not implemented)
Previous implementation:
- Github username may only contain alphanumeric characters or hyphens.
- Github username cannot begin with a hyphen.
Commit: e976b9dfec41fa5eafc05af04c8c10677ea1c679
https://github.com/jenkinsci/ghprb-plugin/commit/e976b9dfec41fa5eafc05af04c8c10677ea1c679
Author: Björn Häuser <[email protected]>
Date: 2017-11-25 (Sat, 25 Nov 2017)
Changed paths:
M CHANGELOG.md
M src/test/java/org/jenkinsci/plugins/ghprb/GhprbTriggerTest.java
Log Message:
-----------
Add Tests and changelog entry
Compare:
https://github.com/jenkinsci/ghprb-plugin/compare/9e8fca0cda90...e976b9dfec41
--
You received this message because you are subscribed to the Google Groups
"Jenkins Commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
