Merge pull request #491 from liskin/JENKINS-34350-notifycommit-csrf

[JENKINS-34350] Fix POST to /git/notifyCommit with CSRF protection on
jenkinsci · Apr 27, 2017 · fd68967 · fd68967
2 parents bc51d27 + 509e137
commit fd68967
Show file tree

Hide file tree

Showing 2 changed files with 91 additions and 0 deletions.
diff --git a/src/main/java/hudson/plugins/git/GitStatusCrumbExclusion.java b/src/main/java/hudson/plugins/git/GitStatusCrumbExclusion.java
@@ -0,0 +1,32 @@
+package hudson.plugins.git;
+
+import hudson.Extension;
+import hudson.security.csrf.CrumbExclusion;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
+/**
+ * Make POST to /git/notifyCommit work with CSRF protection on.
+ */
+@Extension
+public class GitStatusCrumbExclusion extends CrumbExclusion {
+
+    @Override
+    public boolean process(HttpServletRequest req, HttpServletResponse resp, FilterChain chain)
+            throws IOException, ServletException {
+        String pathInfo = req.getPathInfo();
+        if (pathInfo != null && pathInfo.equals(getExclusionPath())) {
+            chain.doFilter(req, resp);
+            return true;
+        }
+        return false;
+    }
+
+    public String getExclusionPath() {
+        return "/git/notifyCommit";
+    }
+}
diff --git a/src/test/java/hudson/plugins/git/GitStatusCrumbExclusionTest.java b/src/test/java/hudson/plugins/git/GitStatusCrumbExclusionTest.java
@@ -0,0 +1,59 @@
+package hudson.plugins.git;
+
+import hudson.security.csrf.CrumbFilter;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+
+import javax.servlet.FilterChain;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import java.util.Collections;
+
+import static org.mockito.Matchers.*;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.jvnet.hudson.test.JenkinsRule;
+
+public class GitStatusCrumbExclusionTest {
+
+    @Rule
+    public JenkinsRule r = new JenkinsRule();
+
+    private CrumbFilter filter;
+    private HttpServletRequest req;
+    private HttpServletResponse resp;
+    private FilterChain chain;
+
+    @Before
+    public void before() {
+        filter = new CrumbFilter();
+        req = mock(HttpServletRequest.class);
+        resp = mock(HttpServletResponse.class);
+        chain = mock(FilterChain.class);
+    }
+
+    @Test
+    public void testNotifyCommit() throws Exception {
+        when(req.getPathInfo()).thenReturn("/git/notifyCommit");
+        when(req.getMethod()).thenReturn("POST");
+        when(req.getParameterNames()).thenReturn(Collections.<String>emptyEnumeration());
+        filter.doFilter(req, resp, chain);
+        verify(resp, never()).sendError(anyInt(), anyString());
+    }
+
+    @Test
+    public void testInvalidPath() throws Exception {
+        when(req.getPathInfo()).thenReturn("/git/somethingElse");
+        when(req.getMethod()).thenReturn("POST");
+        when(req.getParameterNames()).thenReturn(Collections.<String>emptyEnumeration());
+        filter.doFilter(req, resp, chain);
+        verify(resp, times(1)).sendError(anyInt(), anyString());
+    }
+}