Skip to content

Commit

Permalink
forward compatibility for core dialogs (#286)
Browse files Browse the repository at this point in the history
  • Loading branch information
@mawinter69
mawinter69 committed Jul 22, 2023
1 parent 0461b87 commit a544a62
Show file tree
Hide file tree
Showing 4 changed files with 102 additions and 49 deletions.
57 changes: 31 additions & 26 deletions src/test/java/org/jenkinsci/plugins/configfiles/ConfigFilesSEC1253Test.java
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
package org.jenkinsci.plugins.configfiles;

import org.htmlunit.html.HtmlAnchor;
import org.htmlunit.html.HtmlButton;
import org.htmlunit.html.HtmlElement;
import org.htmlunit.html.HtmlForm;
import org.htmlunit.html.HtmlInput;
import org.htmlunit.html.HtmlPage;
Expand Down Expand Up @@ -56,20 +58,21 @@ public void regularCaseStillWorking() throws Exception {
assertThat(store.getConfigs(), hasSize(1));

HtmlPage configFiles = wc.goTo("configfiles");
String attribute = j.jenkins.getVersion().isOlderThan(new VersionNumber("2.324")) ? "onclick" : "data-url";
HtmlAnchor removeAnchor = configFiles.getDocumentElement().getFirstByXPath("//a[contains(@" + attribute + ", 'removeConfig?id=" + CONFIG_ID + "')]");

AtomicReference<Boolean> confirmCalled = new AtomicReference<>(false);
wc.setConfirmHandler((page, s) -> {
confirmCalled.set(true);
return true;
});

assertThat(confirmCalled.get(), is(false));

removeAnchor.click();

assertThat(confirmCalled.get(), is(true));
HtmlAnchor removeAnchor = configFiles.getDocumentElement().getFirstByXPath("//a[contains(@data-url, 'removeConfig?id=" + CONFIG_ID + "')]");

if (j.jenkins.getVersion().isOlderThan(new VersionNumber("2.415"))) {
AtomicReference<Boolean> confirmCalled = new AtomicReference<>(false);
wc.setConfirmHandler((page, s) -> {
confirmCalled.set(true);
return true;
});
assertThat(confirmCalled.get(), is(false));
removeAnchor.click();
assertThat(confirmCalled.get(), is(true));
} else {
HtmlElement document = configFiles.getDocumentElement();
HtmlElementUtil.clickDialogOkButton(removeAnchor, document);
}

assertThat(store.getConfigs(), empty());
}
Expand All @@ -89,25 +92,27 @@ public void xssPrevention() throws Exception {
JenkinsRule.WebClient wc = j.createWebClient();

HtmlPage configFiles = wc.goTo("configfiles");
String attribute = j.jenkins.getVersion().isOlderThan(new VersionNumber("2.324")) ? "onclick" : "data-url";
HtmlAnchor removeAnchor = configFiles.getDocumentElement().getFirstByXPath("//a[contains(@" + attribute + ", 'removeConfig?id=" + CONFIG_ID + "')]");
HtmlAnchor removeAnchor = configFiles.getDocumentElement().getFirstByXPath("//a[contains(@data-url, 'removeConfig?id=" + CONFIG_ID + "')]");

AtomicReference<Boolean> confirmCalled = new AtomicReference<>(false);
AtomicReference<Boolean> alertCalled = new AtomicReference<>(false);
wc.setConfirmHandler((page, s) -> {
confirmCalled.set(true);
return true;
});
wc.setAlertHandler((page, s) -> {
alertCalled.set(true);
});

assertThat(confirmCalled.get(), is(false));
assertThat(alertCalled.get(), is(false));
if (j.jenkins.getVersion().isOlderThan(new VersionNumber("2.415"))) {
AtomicReference<Boolean> confirmCalled = new AtomicReference<>(false);
wc.setConfirmHandler((page, s) -> {
confirmCalled.set(true);
return true;
});
assertThat(confirmCalled.get(), is(false));
removeAnchor.click();
assertThat(confirmCalled.get(), is(true));
} else {
HtmlElement document = configFiles.getDocumentElement();
HtmlElementUtil.clickDialogOkButton(removeAnchor, document);
}

removeAnchor.click();

assertThat(confirmCalled.get(), is(true));
assertThat(alertCalled.get(), is(false));

assertThat(store.getConfigs(), empty());
Expand Down
35 changes: 35 additions & 0 deletions src/test/java/org/jenkinsci/plugins/configfiles/HtmlElementUtil.java
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
package org.jenkinsci.plugins.configfiles;

import java.io.IOException;
import org.htmlunit.Page;
import org.htmlunit.WebClient;
import org.htmlunit.WebClientUtil;
import org.htmlunit.html.HtmlButton;
import org.htmlunit.html.HtmlElement;

public class HtmlElementUtil {
public HtmlElementUtil() {
}

public static void clickDialogOkButton(HtmlElement element, HtmlElement document) throws IOException {
if (element != null) {
boolean var6 = false;

try {
var6 = true;
element.click();
var6 = false;
} finally {
if (var6) {
WebClient var4 = element.getPage().getWebClient();
WebClientUtil.waitForJSExec(var4);
}
}

WebClient webClient = element.getPage().getWebClient();
WebClientUtil.waitForJSExec(webClient);
HtmlButton confirmButton = document.getOneHtmlElementByAttribute("button", "data-id", "ok");
confirmButton.click();
}
}
}
31 changes: 19 additions & 12 deletions src/test/java/org/jenkinsci/plugins/configfiles/folder/FolderConfigFileActionTest.java
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
package org.jenkinsci.plugins.configfiles.folder;

import com.cloudbees.hudson.plugins.folder.Folder;
import org.hamcrest.CoreMatchers;
import org.htmlunit.html.HtmlAnchor;
import org.htmlunit.html.HtmlElement;
import org.htmlunit.html.HtmlPage;
import hudson.model.Item;
import hudson.util.VersionNumber;
Expand All @@ -13,6 +15,7 @@
import org.jenkinsci.plugins.configfiles.ConfigFileStore;
import org.jenkinsci.plugins.configfiles.ConfigFiles;
import org.jenkinsci.plugins.configfiles.GlobalConfigFiles;
import org.jenkinsci.plugins.configfiles.HtmlElementUtil;
import org.jenkinsci.plugins.configfiles.custom.CustomConfig;
import org.jenkinsci.plugins.configfiles.maven.MavenSettingsConfig;
import org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition;
Expand Down Expand Up @@ -242,18 +245,22 @@ public void xssPreventionInFolder() throws Exception {
// Clicking the button works
// If we click on the link, it goes via POST, therefore it removes it successfully
HtmlPage configFiles = wc.goTo(f1.getUrl() + "configfiles");
String attribute = r.jenkins.getVersion().isOlderThan(new VersionNumber("2.324")) ? "onclick" : "data-url";
HtmlAnchor removeAnchor = configFiles.getDocumentElement().getFirstByXPath("//a[contains(@" + attribute + ", 'removeConfig?id=" + CONFIG_ID + "')]");

AtomicReference<Boolean> confirmCalled = new AtomicReference<>(false);
wc.setConfirmHandler((page, s) -> {
confirmCalled.set(true);
return true;
});

assertThat(confirmCalled.get(), is(false));
removeAnchor.click();
assertThat(confirmCalled.get(), is(true));
HtmlAnchor removeAnchor = configFiles.getDocumentElement().getFirstByXPath("//a[contains(@data-url, 'removeConfig?id=" + CONFIG_ID + "')]");

if (r.jenkins.getVersion().isOlderThan(new VersionNumber("2.415"))) {
AtomicReference<Boolean> confirmCalled = new AtomicReference<>(false);
wc.setConfirmHandler((page, s) -> {
confirmCalled.set(true);
return true;
});
assertThat(confirmCalled.get(), CoreMatchers.is(false));
removeAnchor.click();
assertThat(confirmCalled.get(), CoreMatchers.is(true));
} else {
HtmlElement document = configFiles.getDocumentElement();
HtmlElementUtil.clickDialogOkButton(removeAnchor, document);
}

assertThat(store.getConfigs(), empty());
}

Expand Down
28 changes: 17 additions & 11 deletions src/test/java/org/jenkinsci/plugins/configfiles/sec/Security2002Test.java
View file
Original file line number Diff line number Diff line change
@@ -1,10 +1,13 @@
package org.jenkinsci.plugins.configfiles.sec;

import org.hamcrest.CoreMatchers;
import org.htmlunit.html.HtmlAnchor;
import org.htmlunit.html.HtmlElement;
import org.htmlunit.html.HtmlPage;
import hudson.util.VersionNumber;
import jenkins.model.GlobalConfiguration;
import org.jenkinsci.plugins.configfiles.GlobalConfigFiles;
import org.jenkinsci.plugins.configfiles.HtmlElementUtil;
import org.jenkinsci.plugins.configfiles.custom.CustomConfig;
import org.junit.Rule;
import org.junit.Test;
Expand Down Expand Up @@ -51,18 +54,21 @@ public void xssPrevention() throws Exception {
// Clicking the button works
// If we click on the link, it goes via POST, therefore it removes it successfully
HtmlPage configFiles = wc.goTo("configfiles");
String attribute = j.jenkins.getVersion().isOlderThan(new VersionNumber("2.324")) ? "onclick" : "data-url";
HtmlAnchor removeAnchor = configFiles.getDocumentElement().getFirstByXPath("//a[contains(@" + attribute + ", 'removeConfig?id=" + CONFIG_ID + "')]");
HtmlAnchor removeAnchor = configFiles.getDocumentElement().getFirstByXPath("//a[contains(@data-url, 'removeConfig?id=" + CONFIG_ID + "')]");

AtomicReference<Boolean> confirmCalled = new AtomicReference<>(false);
wc.setConfirmHandler((page, s) -> {
confirmCalled.set(true);
return true;
});

assertThat(confirmCalled.get(), is(false));
removeAnchor.click();
assertThat(confirmCalled.get(), is(true));
if (j.jenkins.getVersion().isOlderThan(new VersionNumber("2.415"))) {
AtomicReference<Boolean> confirmCalled = new AtomicReference<>(false);
wc.setConfirmHandler((page, s) -> {
confirmCalled.set(true);
return true;
});
assertThat(confirmCalled.get(), CoreMatchers.is(false));
removeAnchor.click();
assertThat(confirmCalled.get(), CoreMatchers.is(true));
} else {
HtmlElement document = configFiles.getDocumentElement();
HtmlElementUtil.clickDialogOkButton(removeAnchor, document);
}
assertThat(store.getConfigs(), empty());
}
}

0 comments on commit a544a62

Please sign in to comment.