[FIXED JENKINS-12875] Change default crumb name to Jenkins-Crumb

jenkinsci · Mar 31, 2016 · ed0ea63 · Blaisorblade · Apr 30, 2016 · Blaisorblade
1 parent e322322
commit ed0ea63
Show file tree

Hide file tree

Showing 5 changed files with 24 additions and 13 deletions.
diff --git a/core/src/main/java/hudson/security/csrf/CrumbFilter.java b/core/src/main/java/hudson/security/csrf/CrumbFilter.java
@@ -62,17 +62,11 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
             String crumbFieldName = crumbIssuer.getDescriptor().getCrumbRequestField();
             String crumbSalt = crumbIssuer.getDescriptor().getCrumbSalt();
 
-            String crumb = httpRequest.getHeader(crumbFieldName);
             boolean valid = false;
+            String crumb = extractCrumbFromRequest(httpRequest, crumbFieldName);
             if (crumb == null) {
-                Enumeration<?> paramNames = request.getParameterNames();
-                while (paramNames.hasMoreElements()) {
-                    String paramName = (String) paramNames.nextElement();
-                    if (crumbFieldName.equals(paramName)) {
-                        crumb = request.getParameter(paramName);
-                        break;
-                    }
-                }
+                // compatibility for clients that hard-code the default crumb name up to Jenkins 1.TODO
+                extractCrumbFromRequest(httpRequest, ".crumb");
             }
             if (crumb != null) {
                 if (crumbIssuer.validateCrumb(httpRequest, crumbSalt, crumb)) {
@@ -93,6 +87,21 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
         }
     }
 
+    private String extractCrumbFromRequest(HttpServletRequest httpRequest, String crumbFieldName) {
+        String crumb = httpRequest.getHeader(crumbFieldName);
+        if (crumb == null) {
+            Enumeration<?> paramNames = httpRequest.getParameterNames();
+            while (paramNames.hasMoreElements()) {
+                String paramName = (String) paramNames.nextElement();
+                if (crumbFieldName.equals(paramName)) {
+                    crumb = httpRequest.getParameter(paramName);
+                    break;
+                }
+            }
+        }
+        return crumb;
+    }
+
     protected static boolean isMultipart(HttpServletRequest request) {
         if (request == null) {
             return false;

diff --git a/core/src/main/java/hudson/security/csrf/CrumbIssuer.java b/core/src/main/java/hudson/security/csrf/CrumbIssuer.java
@@ -43,6 +43,7 @@
 public abstract class CrumbIssuer implements Describable<CrumbIssuer>, ExtensionPoint {
 
     private static final String CRUMB_ATTRIBUTE = CrumbIssuer.class.getName() + "_crumb";
+    public static final String DEFAULT_CRUMB_NAME = "Jenkins-Crumb";
 
     /**
      * Get the name of the request parameter the crumb will be stored in. Exposed
@@ -199,7 +200,7 @@ public static class RestrictedApi extends Api {
             } else if ("concat(//crumbRequestField,\":\",//crumb)".equals(xpath)) { // new FullDuplexHttpStream; Main
                 text = ci.getCrumbRequestField() + ':' + ci.getCrumb();
             } else if ("concat(//crumbRequestField,'=',//crumb)".equals(xpath)) { // NetBeans
-                if (ci.getCrumbRequestField().startsWith(".")) {
+                if (ci.getCrumbRequestField().startsWith(".") || ci.getCrumbRequestField().contains("-")) {
                     text = ci.getCrumbRequestField() + '=' + ci.getCrumb();
                 } else {
                     text = null;

diff --git a/core/src/main/java/hudson/security/csrf/CrumbIssuerDescriptor.java b/core/src/main/java/hudson/security/csrf/CrumbIssuerDescriptor.java
@@ -64,7 +64,7 @@ public String getCrumbRequestField() {
      */
     public void setCrumbRequestField(String requestField) {
         if (Util.fixEmptyAndTrim(requestField) == null) {
-            crumbRequestField = ".crumb";
+            crumbRequestField = CrumbIssuer.DEFAULT_CRUMB_NAME;
         } else {
             crumbRequestField = requestField;
         }

diff --git a/core/src/main/java/hudson/security/csrf/DefaultCrumbIssuer.java b/core/src/main/java/hudson/security/csrf/DefaultCrumbIssuer.java
@@ -124,7 +124,7 @@ public static final class DescriptorImpl extends CrumbIssuerDescriptor<DefaultCr
         private final static HexStringConfidentialKey CRUMB_SALT = new HexStringConfidentialKey(Jenkins.class,"crumbSalt",16);
 
         public DescriptorImpl() {
-            super(CRUMB_SALT.get(), System.getProperty("hudson.security.csrf.requestfield", ".crumb"));
+            super(CRUMB_SALT.get(), System.getProperty("hudson.security.csrf.requestfield", CrumbIssuer.DEFAULT_CRUMB_NAME));
             load();
         }
 

diff --git a/test/src/test/groovy/hudson/model/SlaveTest.groovy b/test/src/test/groovy/hudson/model/SlaveTest.groovy
@@ -28,6 +28,7 @@ import static hudson.util.FormValidation.Kind.WARNING
 import static org.junit.Assert.assertNotNull
 import static org.junit.Assert.assertEquals
 
+import hudson.security.csrf.CrumbIssuer
 import hudson.slaves.DumbSlave
 import hudson.slaves.JNLPLauncher
 import hudson.util.FormValidation
@@ -84,7 +85,7 @@ class SlaveTest {
         HttpURLConnection con = new URL(j.getURL(),url).openConnection();
         con.requestMethod = "POST"
         con.setRequestProperty("Content-Type","application/xml;charset=UTF-8")
-        con.setRequestProperty(".crumb","test")
+        con.setRequestProperty(CrumbIssuer.DEFAULT_CRUMB_NAME,"test")
         con.doOutput = true;
         con.outputStream.write(xml.getBytes("UTF-8"))
         con.outputStream.close();