[JENKINS-34758] Test for SECURITY-170

src/test/java/hudson/matrix/MatrixProjectTest.java

@@ -70,6 +70,7 @@
 import hudson.model.ParametersAction;
 import hudson.model.FileParameterValue;
 import hudson.model.StringParameterDefinition;
+import hudson.model.StringParameterValue;
 
 import java.util.List;
 import java.util.ArrayList;
@@ -412,6 +413,24 @@ public void testTwoFileParams() throws Exception {
         j.assertBuildStatusSuccess(f.get(10,TimeUnit.SECONDS));
     }
 
+    @Issue("JENKINS-34758")
+    @Test
+    public void testParametersAsEnvOnChildren() throws Exception {
+        MatrixProject p = createMatrixProject();
+        p.setAxes(new AxisList(new TextAxis("foo","1")));
+        p.addProperty(new ParametersDefinitionProperty(
+            new StringParameterDefinition("MY_PARAM","")
+        ));
+        // must fail if $MY_PARAM or $foo are not defined in children
+        p.getBuildersList().add(new Shell("set -eux; echo $MY_PARAM; echo $foo"));
+
+        List<ParameterValue> params = new ArrayList<ParameterValue>();
+        params.add(new StringParameterValue("MY_PARAM", "value1"));
+
+        QueueTaskFuture<MatrixBuild> f = p.scheduleBuild2(0, new LegacyCodeCause(), new ParametersAction(params));
+        j.assertBuildStatusSuccess(f.get());
+    }
+
     /**
      * Verifies that the concurrent build feature works, and makes sure
      * that each gets its own unique workspace.