@Test public void getSecurityWarningsTest() { setTestUcJson(); Map<String, List<SecurityWarning>> allSecurityWarnings = pm.getSecurityWarnings(); assertThat(allSecurityWarnings) .doesNotContainKey("core") .hasSize(3); SecurityWarning googleLoginSecurityWarning = allSecurityWarnings.get("google-login").get(0); assertThat(googleLoginSecurityWarning.getId()).isEqualTo("SECURITY-208"); assertThat(googleLoginSecurityWarning.getSecurityVersions().get(0).getPattern()) .hasToString("1[.][01](|[.-].*)"); List<SecurityWarning> pipelineMavenSecurityWarning = allSecurityWarnings.get("pipeline-maven"); assertThat(pipelineMavenSecurityWarning) .extracting(warning -> warning.getId() + " " + warning.getMessage() + " " + warning.getUrl()) .containsExactlyInAnyOrder( "SECURITY-441 Arbitrary files from Jenkins master available in Pipeline by using the " + "withMaven step https: "SECURITY-1409 XML External Entity processing vulnerability " + "https: assertThat(pipelineMavenSecurityWarning.get(0).getSecurityVersions()) .hasSize(2); }
public Map<String, List<SecurityWarning>> getSecurityWarnings() { if (latestUcJson == null) { System.out.println("Unable to get update center json"); return allSecurityWarnings; } if (!latestUcJson.has("warnings")) { System.out.println("update center json has no warnings: ignoring"); return allSecurityWarnings; } JSONArray warnings = latestUcJson.getJSONArray("warnings"); for (int i = 0; i < warnings.length(); i++) { JSONObject warning = warnings.getJSONObject(i); String warningType = warning.getString("type"); if (!warningType.equals("plugin")) { continue; } String warningId = warning.getString("id"); String warningMessage = warning.getString("message"); String warningName = warning.getString("name"); String warningUrl = warning.getString("url"); SecurityWarning securityWarning = new SecurityWarning(warningId, warningMessage, warningName, warningUrl); JSONArray warningVersions = warning.getJSONArray("versions"); for (int j = 0; j < warningVersions.length(); j++) { JSONObject warningVersion = warningVersions.getJSONObject(j); String firstVersion = ""; if (warningVersion.has("firstVersion")) { firstVersion = warningVersion.getString("firstVersion"); } String lastVersion = ""; if (warningVersion.has("lastVersion")) { lastVersion = warningVersion.getString("lastVersion"); } String pattern = warningVersion.getString("pattern"); securityWarning.addSecurityVersion(firstVersion, lastVersion, pattern); } allSecurityWarnings.computeIfAbsent(warningName, k -> new ArrayList<>()).add(securityWarning); } return allSecurityWarnings; }
PluginManager { public Map<String, List<SecurityWarning>> getSecurityWarnings() { if (latestUcJson == null) { System.out.println("Unable to get update center json"); return allSecurityWarnings; } if (!latestUcJson.has("warnings")) { System.out.println("update center json has no warnings: ignoring"); return allSecurityWarnings; } JSONArray warnings = latestUcJson.getJSONArray("warnings"); for (int i = 0; i < warnings.length(); i++) { JSONObject warning = warnings.getJSONObject(i); String warningType = warning.getString("type"); if (!warningType.equals("plugin")) { continue; } String warningId = warning.getString("id"); String warningMessage = warning.getString("message"); String warningName = warning.getString("name"); String warningUrl = warning.getString("url"); SecurityWarning securityWarning = new SecurityWarning(warningId, warningMessage, warningName, warningUrl); JSONArray warningVersions = warning.getJSONArray("versions"); for (int j = 0; j < warningVersions.length(); j++) { JSONObject warningVersion = warningVersions.getJSONObject(j); String firstVersion = ""; if (warningVersion.has("firstVersion")) { firstVersion = warningVersion.getString("firstVersion"); } String lastVersion = ""; if (warningVersion.has("lastVersion")) { lastVersion = warningVersion.getString("lastVersion"); } String pattern = warningVersion.getString("pattern"); securityWarning.addSecurityVersion(firstVersion, lastVersion, pattern); } allSecurityWarnings.computeIfAbsent(warningName, k -> new ArrayList<>()).add(securityWarning); } return allSecurityWarnings; } }
PluginManager { public Map<String, List<SecurityWarning>> getSecurityWarnings() { if (latestUcJson == null) { System.out.println("Unable to get update center json"); return allSecurityWarnings; } if (!latestUcJson.has("warnings")) { System.out.println("update center json has no warnings: ignoring"); return allSecurityWarnings; } JSONArray warnings = latestUcJson.getJSONArray("warnings"); for (int i = 0; i < warnings.length(); i++) { JSONObject warning = warnings.getJSONObject(i); String warningType = warning.getString("type"); if (!warningType.equals("plugin")) { continue; } String warningId = warning.getString("id"); String warningMessage = warning.getString("message"); String warningName = warning.getString("name"); String warningUrl = warning.getString("url"); SecurityWarning securityWarning = new SecurityWarning(warningId, warningMessage, warningName, warningUrl); JSONArray warningVersions = warning.getJSONArray("versions"); for (int j = 0; j < warningVersions.length(); j++) { JSONObject warningVersion = warningVersions.getJSONObject(j); String firstVersion = ""; if (warningVersion.has("firstVersion")) { firstVersion = warningVersion.getString("firstVersion"); } String lastVersion = ""; if (warningVersion.has("lastVersion")) { lastVersion = warningVersion.getString("lastVersion"); } String pattern = warningVersion.getString("pattern"); securityWarning.addSecurityVersion(firstVersion, lastVersion, pattern); } allSecurityWarnings.computeIfAbsent(warningName, k -> new ArrayList<>()).add(securityWarning); } return allSecurityWarnings; } @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "we want the user to be able to specify a path")  PluginManager(Config cfg); }
PluginManager { public Map<String, List<SecurityWarning>> getSecurityWarnings() { if (latestUcJson == null) { System.out.println("Unable to get update center json"); return allSecurityWarnings; } if (!latestUcJson.has("warnings")) { System.out.println("update center json has no warnings: ignoring"); return allSecurityWarnings; } JSONArray warnings = latestUcJson.getJSONArray("warnings"); for (int i = 0; i < warnings.length(); i++) { JSONObject warning = warnings.getJSONObject(i); String warningType = warning.getString("type"); if (!warningType.equals("plugin")) { continue; } String warningId = warning.getString("id"); String warningMessage = warning.getString("message"); String warningName = warning.getString("name"); String warningUrl = warning.getString("url"); SecurityWarning securityWarning = new SecurityWarning(warningId, warningMessage, warningName, warningUrl); JSONArray warningVersions = warning.getJSONArray("versions"); for (int j = 0; j < warningVersions.length(); j++) { JSONObject warningVersion = warningVersions.getJSONObject(j); String firstVersion = ""; if (warningVersion.has("firstVersion")) { firstVersion = warningVersion.getString("firstVersion"); } String lastVersion = ""; if (warningVersion.has("lastVersion")) { lastVersion = warningVersion.getString("lastVersion"); } String pattern = warningVersion.getString("pattern"); securityWarning.addSecurityVersion(firstVersion, lastVersion, pattern); } allSecurityWarnings.computeIfAbsent(warningName, k -> new ArrayList<>()).add(securityWarning); } return allSecurityWarnings; } @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "we want the user to be able to specify a path")  PluginManager(Config cfg); void start(); void start(boolean downloadUc); List<Plugin> findPluginsToDownload(Map<String, Plugin> requestedPlugins); Map<String, Plugin> findEffectivePlugins(List<Plugin> pluginsToBeDownloaded); void listPlugins(); void logPlugins(String description, List<Plugin> plugins); Map<String, List<SecurityWarning>> getSecurityWarnings(); void showAllSecurityWarnings(); void showSpecificSecurityWarnings(List<Plugin> plugins); List<Plugin> getLatestVersionsOfPlugins(List<Plugin> plugins); boolean warningExists(Plugin plugin); void checkVersionCompatibility(VersionNumber jenkinsVersion, List<Plugin> pluginsToBeDownloaded); void downloadPlugins(List<Plugin> plugins); Map<String, Plugin> findPluginsAndDependencies(List<Plugin> requestedPlugins); void outputPluginReplacementInfo(Plugin lowerVersion, Plugin higherVersion); @Deprecated JSONObject getJson(String urlString); JSONObject getJson(URL url, String cacheKey); void getUCJson(VersionNumber jenkinsVersion); JSONArray getPluginDependencyJsonArray(Plugin plugin, JSONObject ucJson); VersionNumber getLatestPluginVersion(String pluginName); List<Plugin> resolveDependenciesFromManifest(Plugin plugin); List<Plugin> resolveDependenciesFromJson(Plugin plugin, JSONObject pluginJson); List<Plugin> resolveDirectDependencies(Plugin plugin); Map<String, Plugin> resolveRecursiveDependencies(Plugin plugin); boolean downloadPlugin(Plugin plugin, File location); String getPluginDownloadUrl(Plugin plugin); boolean downloadToFile(String urlString, Plugin plugin, File fileLocation); @SuppressFBWarnings({"RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE", "PATH_TRAVERSAL_IN"}) boolean downloadToFile(String urlString, Plugin plugin, File fileLocation, int maxRetries); String getAttributeFromManifest(File file, String key); VersionNumber getJenkinsVersionFromWar(); String getPluginVersion(File file); Map<String, Plugin> installedPlugins(); @SuppressFBWarnings({"RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE", "PATH_TRAVERSAL_IN"}) Map<String, Plugin> bundledPlugins(); String getJenkinsUCLatest(); void setJenkinsUCLatest(String updateCenterLatest); void setInstalledPluginVersions(Map<String, Plugin> installedPlugins); void setBundledPluginVersions(Map<String, Plugin> bundledPlugins); void setAllPluginsAndDependencies(Map<String, Plugin> allPluginsAndDependencies); void setEffectivePlugins(Map<String, Plugin> effectivePlugins); void setPluginsToBeDownloaded(List<Plugin> pluginsToBeDownloaded); void logVerbose(String message); void setLatestUcJson(JSONObject latestUcJson); void setLatestUcPlugins(JSONObject latestPlugins); void setExperimentalUcJson(JSONObject experimentalUcJson); void setAllSecurityWarnings(Map<String, List<SecurityWarning>> securityWarnings); void setPluginInfoJson(JSONObject pluginInfoJson); void setCm(CacheManager cm); List<Plugin> getFailedPlugins(); }
PluginManager { public Map<String, List<SecurityWarning>> getSecurityWarnings() { if (latestUcJson == null) { System.out.println("Unable to get update center json"); return allSecurityWarnings; } if (!latestUcJson.has("warnings")) { System.out.println("update center json has no warnings: ignoring"); return allSecurityWarnings; } JSONArray warnings = latestUcJson.getJSONArray("warnings"); for (int i = 0; i < warnings.length(); i++) { JSONObject warning = warnings.getJSONObject(i); String warningType = warning.getString("type"); if (!warningType.equals("plugin")) { continue; } String warningId = warning.getString("id"); String warningMessage = warning.getString("message"); String warningName = warning.getString("name"); String warningUrl = warning.getString("url"); SecurityWarning securityWarning = new SecurityWarning(warningId, warningMessage, warningName, warningUrl); JSONArray warningVersions = warning.getJSONArray("versions"); for (int j = 0; j < warningVersions.length(); j++) { JSONObject warningVersion = warningVersions.getJSONObject(j); String firstVersion = ""; if (warningVersion.has("firstVersion")) { firstVersion = warningVersion.getString("firstVersion"); } String lastVersion = ""; if (warningVersion.has("lastVersion")) { lastVersion = warningVersion.getString("lastVersion"); } String pattern = warningVersion.getString("pattern"); securityWarning.addSecurityVersion(firstVersion, lastVersion, pattern); } allSecurityWarnings.computeIfAbsent(warningName, k -> new ArrayList<>()).add(securityWarning); } return allSecurityWarnings; } @SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "we want the user to be able to specify a path")  PluginManager(Config cfg); void start(); void start(boolean downloadUc); List<Plugin> findPluginsToDownload(Map<String, Plugin> requestedPlugins); Map<String, Plugin> findEffectivePlugins(List<Plugin> pluginsToBeDownloaded); void listPlugins(); void logPlugins(String description, List<Plugin> plugins); Map<String, List<SecurityWarning>> getSecurityWarnings(); void showAllSecurityWarnings(); void showSpecificSecurityWarnings(List<Plugin> plugins); List<Plugin> getLatestVersionsOfPlugins(List<Plugin> plugins); boolean warningExists(Plugin plugin); void checkVersionCompatibility(VersionNumber jenkinsVersion, List<Plugin> pluginsToBeDownloaded); void downloadPlugins(List<Plugin> plugins); Map<String, Plugin> findPluginsAndDependencies(List<Plugin> requestedPlugins); void outputPluginReplacementInfo(Plugin lowerVersion, Plugin higherVersion); @Deprecated JSONObject getJson(String urlString); JSONObject getJson(URL url, String cacheKey); void getUCJson(VersionNumber jenkinsVersion); JSONArray getPluginDependencyJsonArray(Plugin plugin, JSONObject ucJson); VersionNumber getLatestPluginVersion(String pluginName); List<Plugin> resolveDependenciesFromManifest(Plugin plugin); List<Plugin> resolveDependenciesFromJson(Plugin plugin, JSONObject pluginJson); List<Plugin> resolveDirectDependencies(Plugin plugin); Map<String, Plugin> resolveRecursiveDependencies(Plugin plugin); boolean downloadPlugin(Plugin plugin, File location); String getPluginDownloadUrl(Plugin plugin); boolean downloadToFile(String urlString, Plugin plugin, File fileLocation); @SuppressFBWarnings({"RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE", "PATH_TRAVERSAL_IN"}) boolean downloadToFile(String urlString, Plugin plugin, File fileLocation, int maxRetries); String getAttributeFromManifest(File file, String key); VersionNumber getJenkinsVersionFromWar(); String getPluginVersion(File file); Map<String, Plugin> installedPlugins(); @SuppressFBWarnings({"RCN_REDUNDANT_NULLCHECK_WOULD_HAVE_BEEN_A_NPE", "PATH_TRAVERSAL_IN"}) Map<String, Plugin> bundledPlugins(); String getJenkinsUCLatest(); void setJenkinsUCLatest(String updateCenterLatest); void setInstalledPluginVersions(Map<String, Plugin> installedPlugins); void setBundledPluginVersions(Map<String, Plugin> bundledPlugins); void setAllPluginsAndDependencies(Map<String, Plugin> allPluginsAndDependencies); void setEffectivePlugins(Map<String, Plugin> effectivePlugins); void setPluginsToBeDownloaded(List<Plugin> pluginsToBeDownloaded); void logVerbose(String message); void setLatestUcJson(JSONObject latestUcJson); void setLatestUcPlugins(JSONObject latestPlugins); void setExperimentalUcJson(JSONObject experimentalUcJson); void setAllSecurityWarnings(Map<String, List<SecurityWarning>> securityWarnings); void setPluginInfoJson(JSONObject pluginInfoJson); void setCm(CacheManager cm); List<Plugin> getFailedPlugins();  }