From 65b2964759db64f81fa17e393c3d597bd6843ef0 Mon Sep 17 00:00:00 2001
From: Tim Jacomb <timjacomb1+github@gmail.com>
Date: Tue, 3 Aug 2021 08:40:12 +0100
Subject: [PATCH 1/5] Towards 2.302.1

---
 .mvn/maven.config | 1 +
 packaging-ref.txt | 2 +-
 pom.xml           | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.mvn/maven.config b/.mvn/maven.config
index 2a0299c4865d..8c7926b06123 100644
--- a/.mvn/maven.config
+++ b/.mvn/maven.config
@@ -1,2 +1,3 @@
 -Pconsume-incrementals
 -Pmight-produce-incrementals
+-Plts-release
diff --git a/packaging-ref.txt b/packaging-ref.txt
index 1f7391f92b6a..7d4f0b1d4883 100644
--- a/packaging-ref.txt
+++ b/packaging-ref.txt
@@ -1 +1 @@
-master
+stable-2.302
diff --git a/pom.xml b/pom.xml
index d05e1ba12b67..d1a9dafbf5ff 100644
--- a/pom.xml
+++ b/pom.xml
@@ -69,7 +69,7 @@ THE SOFTWARE.
   </issueManagement>
 
   <properties>
-    <revision>2.303</revision>
+    <revision>2.302.1</revision>
     <changelist>-SNAPSHOT</changelist>
 
     <!-- *.html files are in UTF-8, and *.properties are in iso-8859-1, so this configuration is actually incorrect,

From 93ecf94b1116a7e6f364bd350751eb399cdfb768 Mon Sep 17 00:00:00 2001
From: Antonio Muniz <amuniz@users.noreply.github.com>
Date: Tue, 27 Jul 2021 21:00:27 +0200
Subject: [PATCH 2/5] [JENKINS-66177] Ability to disable Java 11 monitor
 (#5628)

(cherry picked from commit 0b0085d252ee770480de86e000fc8810526a9971)
---
 .../monitor/JavaVersionRecommendationAdminMonitor.java       | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/core/src/main/java/jenkins/monitor/JavaVersionRecommendationAdminMonitor.java b/core/src/main/java/jenkins/monitor/JavaVersionRecommendationAdminMonitor.java
index 33adc87e559f..c32870538641 100644
--- a/core/src/main/java/jenkins/monitor/JavaVersionRecommendationAdminMonitor.java
+++ b/core/src/main/java/jenkins/monitor/JavaVersionRecommendationAdminMonitor.java
@@ -28,6 +28,7 @@
 import hudson.model.AdministrativeMonitor;
 import hudson.security.Permission;
 import jenkins.model.Jenkins;
+import jenkins.util.SystemProperties;
 import jenkins.util.java.JavaUtils;
 import org.jenkinsci.Symbol;
 import org.kohsuke.accmod.Restricted;
@@ -46,9 +47,11 @@
 @Symbol("javaVersionRecommendation")
 public class JavaVersionRecommendationAdminMonitor extends AdministrativeMonitor {
 
+    private static Boolean disabled = SystemProperties.getBoolean(JavaVersionRecommendationAdminMonitor.class.getName() + ".disabled", false);
+
     @Override
     public boolean isActivated() {
-        return JavaUtils.isRunningWithJava8OrBelow();
+        return !disabled && JavaUtils.isRunningWithJava8OrBelow();
     }
 
     @Override

From e3a8795769a9428a8451565acf473e33e21687f4 Mon Sep 17 00:00:00 2001
From: EBIBO <stu995106@hotmail.com.tw>
Date: Thu, 29 Jul 2021 15:02:24 +0800
Subject: [PATCH 3/5] [JENKINS-65923] Accessibility issue - Images lacking
 "alt" text (#5634)

(cherry picked from commit 9bf8b33f90d184b2ef98145d74344ff5e49c7dbd)
---
 core/src/main/resources/lib/layout/icon.jelly | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/src/main/resources/lib/layout/icon.jelly b/core/src/main/resources/lib/layout/icon.jelly
index 1f6eec8a42ed..e4b4c47b2ea7 100644
--- a/core/src/main/resources/lib/layout/icon.jelly
+++ b/core/src/main/resources/lib/layout/icon.jelly
@@ -70,9 +70,9 @@ THE SOFTWARE.
 
       <span class="build-status-icon__wrapper ${attrs.class}" style="${imgStyle}">
           <span class="build-status-icon__outer">
-            <l:svgIcon href="${rootURL}/images/build-status/build-status-sprite.svg#${outerLayer}" id="${attrs.id}" />
+            <l:svgIcon href="${rootURL}/images/build-status/build-status-sprite.svg#${outerLayer}" id="${attrs.id}" tooltip="${attrs.tooltip}"/>
           </span>
-          <l:svgIcon class="${attrs.class}" href="${iconSrc}" id="${attrs.id}"/>
+          <l:svgIcon class="${attrs.class}" href="${iconSrc}" id="${attrs.id}" tooltip="${attrs.tooltip}"/>
       </span>
     </j:when>
 

From 12764e8e8d96d2812de4e31957491c3b8b15f707 Mon Sep 17 00:00:00 2001
From: Trung Pham <trungpaaa@gmail.com>
Date: Thu, 8 Jul 2021 19:05:32 +0700
Subject: [PATCH 4/5] Use Path.startsWith() for subdirectory check when
 unzipping

(cherry picked from commit 0c89a7f45762d55abe63451dabe4234421e5501f)
---
 core/src/main/java/hudson/FilePath.java       |   2 +-
 test/src/test/java/hudson/FilePathTest.java   |  59 ++++++++++++++++++
 .../ZipSlipSamePathPrefix/evil-win.zip        | Bin 0 -> 220 bytes
 .../ZipSlipSamePathPrefix/evil.zip            | Bin 0 -> 220 bytes
 4 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 test/src/test/resources/hudson/FilePathTest/ZipSlipSamePathPrefix/evil-win.zip
 create mode 100644 test/src/test/resources/hudson/FilePathTest/ZipSlipSamePathPrefix/evil.zip

diff --git a/core/src/main/java/hudson/FilePath.java b/core/src/main/java/hudson/FilePath.java
index f785d0c8815e..428f878bbfe5 100644
--- a/core/src/main/java/hudson/FilePath.java
+++ b/core/src/main/java/hudson/FilePath.java
@@ -697,7 +697,7 @@ private void unzip(File dir, File zipFile) throws IOException {
             while (entries.hasMoreElements()) {
                 ZipEntry e = entries.nextElement();
                 File f = new File(dir, e.getName());
-                if (!f.getCanonicalPath().startsWith(dir.getCanonicalPath())) {
+                if (!f.getCanonicalFile().toPath().startsWith(dir.getCanonicalPath())) {
                     throw new IOException(
                         "Zip " + zipFile.getPath() + " contains illegal file name that breaks out of the target directory: " + e.getName());
                 }
diff --git a/test/src/test/java/hudson/FilePathTest.java b/test/src/test/java/hudson/FilePathTest.java
index b6294400d7d8..6b70b4e7256b 100644
--- a/test/src/test/java/hudson/FilePathTest.java
+++ b/test/src/test/java/hudson/FilePathTest.java
@@ -222,4 +222,63 @@ public void zipTarget_relative() throws Exception {
         assertThat(simple1.exists(), is(true));
         assertThat(simple2.exists(), is(true));
     }
+
+    @Test
+    @Issue("JENKINS-66094")
+    @LocalData("ZipSlipSamePathPrefix")
+    public void zipSlipSamePathPrefix() throws Exception {
+        assumeFalse(Functions.isWindows());
+
+        // > unzip -l evil.zip
+        // good.txt
+        //  ../foo_evil.txt
+        FilePath zipFile = r.jenkins.getRootPath().child("evil.zip");
+
+        // foo_evil.txt will be extracted to unzip-target/foo_evil.txt
+        // which has the same path prefix as unzip-target/foo
+        FilePath targetLocationParent = r.jenkins.getRootPath().child("unzip-target");
+        FilePath targetLocationFoo = targetLocationParent.child("foo");
+        FilePath evilEntry = targetLocationParent.child("foo_evil.txt");
+
+        assertThat(evilEntry.exists(), is(false));
+
+        try {
+            zipFile.unzip(targetLocationFoo);
+            fail("The ../foo_evil.txt should have triggered an exception");
+        } catch(IOException e){
+            e.printStackTrace();
+            assertThat(e.getMessage(), containsString("contains illegal file name that breaks out of the target directory"));
+        }
+
+        assertThat(evilEntry.exists(), is(false));
+    }
+
+    @Test
+    @Issue("JENKINS-66094")
+    @LocalData("ZipSlipSamePathPrefix")
+    public void zipSlipSamePathPrefixWin() throws Exception {
+        assumeTrue(Functions.isWindows());
+
+        // > unzip -l evil-win.zip
+        // good.txt
+        //  ..\foo_evil.txt
+        FilePath zipFile = r.jenkins.getRootPath().child("evil-win.zip");
+
+        // foo_evil.txt will be extracted to unzip-target\foo_evil.txt
+        // which has the same path prefix as unzip-target\foo
+        FilePath targetLocationParent = r.jenkins.getRootPath().child("unzip-target");
+        FilePath targetLocationFoo = targetLocationParent.child("foo");
+        FilePath evilEntry = targetLocationParent.child("foo_evil.txt");
+
+        assertThat(evilEntry.exists(), is(false));
+
+        try {
+            zipFile.unzip(targetLocationFoo);
+            fail("The ../foo_evil.txt should have triggered an exception");
+        } catch(IOException e){
+            assertThat(e.getMessage(), containsString("contains illegal file name that breaks out of the target directory"));
+        }
+
+        assertThat(evilEntry.exists(), is(false));
+    }
 }
diff --git a/test/src/test/resources/hudson/FilePathTest/ZipSlipSamePathPrefix/evil-win.zip b/test/src/test/resources/hudson/FilePathTest/ZipSlipSamePathPrefix/evil-win.zip
new file mode 100644
index 0000000000000000000000000000000000000000..0cc0d9bedf994f0215029168c9c831f31670641c
GIT binary patch
literal 220
zcmWIWW@Zs#00EJ<7eQbKl;8l;>G}C7dL<Pl0dQ5aXsY;us`T_?((?1;Q_C`QAc`58
pM3`|K3bSNMBZ!5t0-+0=B?w(=KqiKjtZX0!Oh8x+q=P{m1_1H4AP)cl

literal 0
HcmV?d00001

diff --git a/test/src/test/resources/hudson/FilePathTest/ZipSlipSamePathPrefix/evil.zip b/test/src/test/resources/hudson/FilePathTest/ZipSlipSamePathPrefix/evil.zip
new file mode 100644
index 0000000000000000000000000000000000000000..dfc24cbbfe3dcf4cf41ac28b8a76532f7f572ddf
GIT binary patch
literal 220
zcmWIWW@Zs#00EJ<7eQbKl;8l;>G}C7dL<Pl0dQ5aXsY;us`T{q)AIA<Q_C`QAc`58
pM3`|K3bSNMBZ!5t0-+0=B?w(=KqiKjtZX0!Oh8x+q=P{m1_049AGH7g

literal 0
HcmV?d00001


From 700f97414699e904aed7b169b02b50969990b290 Mon Sep 17 00:00:00 2001
From: Ramon Leon <manuelramonleonjimenez@gmail.com>
Date: Thu, 22 Jul 2021 18:08:32 +0200
Subject: [PATCH 5/5] [JENKINS-66139] Avoid polluting the log if usage stats
 cannot be sent (#5621)

* [JENKINS-66139] Avoid polluting the log if usage stats cannot be sent

* Update core/src/main/java/hudson/model/UsageStatistics.java

Co-authored-by: James Nord <jtnord@users.noreply.github.com>

* Update core/src/main/java/hudson/model/UsageStatistics.java

Co-authored-by: James Nord <jtnord@users.noreply.github.com>

* Update core/src/main/java/hudson/model/UsageStatistics.java

Co-authored-by: James Nord <jtnord@users.noreply.github.com>
(cherry picked from commit 1f1eb71d0c05d4b27cce8517ab4fb5ff2ea1ba76)
---
 .../main/java/hudson/model/UsageStatistics.java    | 14 +++++++++++---
 .../hudson/model/UsageStatistics/footer.jelly      | 13 ++++++++-----
 2 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/core/src/main/java/hudson/model/UsageStatistics.java b/core/src/main/java/hudson/model/UsageStatistics.java
index 0e2bf9ea723f..59f177910be7 100644
--- a/core/src/main/java/hudson/model/UsageStatistics.java
+++ b/core/src/main/java/hudson/model/UsageStatistics.java
@@ -63,6 +63,9 @@
 import java.util.ArrayList;
 import java.util.Base64;
 import java.util.List;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
 import com.jcraft.jzlib.GZIPOutputStream;
 import jenkins.util.SystemProperties;
 
@@ -71,6 +74,8 @@
  */
 @Extension
 public class UsageStatistics extends PageDecorator implements PersistentDescriptor {
+    private static final Logger LOG = Logger.getLogger(UsageStatistics.class.getName());
+    
     private final String keyImage;
 
     /**
@@ -122,7 +127,8 @@ private RSAPublicKey getKey() {
     }
 
     /**
-     * Gets the encrypted usage stat data to be sent to the Hudson server.
+     * Gets the encrypted usage stat data to be sent to the Hudson server. 
+     * Used exclusively by jelly: resources/hudson/model/UsageStatistics/footer.jelly
      */
     public String getStatData() throws IOException {
         Jenkins j = Jenkins.get();
@@ -190,8 +196,10 @@ public String getStatData() throws IOException {
             }
 
             return new String(Base64.getEncoder().encode(baos.toByteArray()));
-        } catch (GeneralSecurityException e) {
-            throw new Error(e); // impossible
+        } catch (Throwable e) { // the exception could be GeneralSecurityException, InvalidParameterException or any other depending on the security provider you have installed
+            LOG.log(Level.INFO, "Usage statistics could not be sent ({0})", e.getMessage());
+            LOG.log(Level.FINE, "Error sending usage statistics", e);
+            return null;
         }
     }
 
diff --git a/core/src/main/resources/hudson/model/UsageStatistics/footer.jelly b/core/src/main/resources/hudson/model/UsageStatistics/footer.jelly
index b532b3d74674..1b0771b539d3 100644
--- a/core/src/main/resources/hudson/model/UsageStatistics/footer.jelly
+++ b/core/src/main/resources/hudson/model/UsageStatistics/footer.jelly
@@ -32,10 +32,13 @@ THE SOFTWARE.
 <?jelly escape-by-default='true'?>
 <j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
   <j:if test="${it.due}">
-    <script>
-      Behaviour.addLoadEvent(function() {
-        loadScript("https://usage.jenkins.io/usage-stats.js?${it.statData}");
-      });
-    </script>
+    <j:set var="statData" value="${it.statData}"/>
+    <j:if test="${statData != null}">
+      <script>
+        Behaviour.addLoadEvent(function() {
+          loadScript("https://usage.jenkins.io/usage-stats.js?${statData}");
+        });
+      </script>
+    </j:if>
   </j:if>
 </j:jelly>