Skip to content
Permalink
Browse files

Merge pull request #491 from liskin/JENKINS-34350-notifycommit-csrf

[JENKINS-34350] Fix POST to /git/notifyCommit with CSRF protection on
  • Loading branch information...
MarkEWaite committed Apr 27, 2017
2 parents bc51d27 + 509e137 commit fd68967a4cb08ecfbcad47dce47943851f247bbf
@@ -0,0 +1,32 @@
package hudson.plugins.git;

import hudson.Extension;
import hudson.security.csrf.CrumbExclusion;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
* Make POST to /git/notifyCommit work with CSRF protection on.
*/
@Extension
public class GitStatusCrumbExclusion extends CrumbExclusion {

@Override
public boolean process(HttpServletRequest req, HttpServletResponse resp, FilterChain chain)
throws IOException, ServletException {
String pathInfo = req.getPathInfo();
if (pathInfo != null && pathInfo.equals(getExclusionPath())) {
chain.doFilter(req, resp);
return true;
}
return false;
}

public String getExclusionPath() {
return "/git/notifyCommit";
}
}
@@ -0,0 +1,59 @@
package hudson.plugins.git;

import hudson.security.csrf.CrumbFilter;

import org.junit.Before;
import org.junit.Rule;
import org.junit.Test;

import javax.servlet.FilterChain;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import java.util.Collections;

import static org.mockito.Matchers.*;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.never;
import static org.mockito.Mockito.times;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.when;

import org.jvnet.hudson.test.JenkinsRule;

public class GitStatusCrumbExclusionTest {

@Rule
public JenkinsRule r = new JenkinsRule();

private CrumbFilter filter;
private HttpServletRequest req;
private HttpServletResponse resp;
private FilterChain chain;

@Before
public void before() {
filter = new CrumbFilter();
req = mock(HttpServletRequest.class);
resp = mock(HttpServletResponse.class);
chain = mock(FilterChain.class);
}

@Test
public void testNotifyCommit() throws Exception {
when(req.getPathInfo()).thenReturn("/git/notifyCommit");
when(req.getMethod()).thenReturn("POST");
when(req.getParameterNames()).thenReturn(Collections.<String>emptyEnumeration());
filter.doFilter(req, resp, chain);
verify(resp, never()).sendError(anyInt(), anyString());
}

@Test
public void testInvalidPath() throws Exception {
when(req.getPathInfo()).thenReturn("/git/somethingElse");
when(req.getMethod()).thenReturn("POST");
when(req.getParameterNames()).thenReturn(Collections.<String>emptyEnumeration());
filter.doFilter(req, resp, chain);
verify(resp, times(1)).sendError(anyInt(), anyString());
}
}

0 comments on commit fd68967

Please sign in to comment.
You can’t perform that action at this time.