[SECURITY-1579] Transform initial expressions for parameters in const…

…ructors that call super
jenkinsci · Sep 25, 2019 · 415b6e2 · 415b6e2
1 parent 492a579
commit 415b6e2
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/pom.xml b/pom.xml
@@ -51,7 +51,7 @@
     <dependency>
       <groupId>org.kohsuke</groupId>
       <artifactId>groovy-sandbox</artifactId>
-      <version>1.23</version>
+      <version>1.24</version>
       <exclusions>
         <exclusion>
           <groupId>org.codehaus.groovy</groupId>

diff --git a/...test/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptorTest.java b/...test/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SandboxInterceptorTest.java
@@ -1261,4 +1261,17 @@ public void scriptInitializersClassSyntax() throws Exception {
                 "import jenkins.model.Jenkins\n" +
                 "({ Jenkins.getInstance(); 1 }())++\n");
     }
+
+    @Issue("SECURITY-1579")
+    @Test public void blockInitialExpressionsInConstructorsCallingSuper() throws Exception {
+        assertRejected(new GenericWhitelist(), "staticMethod jenkins.model.Jenkins getInstance",
+                "import jenkins.model.Jenkins\n" +
+                "class B {}\n" +
+                "class A extends B {\n" +
+                "  A(x = Jenkins.getInstance()) {\n" +
+                "    super()\n" +
+                "  }\n" +
+                "}\n" +
+                "new A()\n");
+    }
 }