Repository navigation
ci: add the Jenkins Security Scan - #34
Merged
Merged
Conversation
CodeQL with the jenkins-infra query pack rather than the generic Java one, so it looks for what plugins get wrong: unsafe Stapler bindings, do* methods missing a permission check or CSRF protection, XSS through Jelly. The archetype ships this for every new plugin and this repository never had it. The plugin has precisely that surface. BuildAddUrl.BuildUrlAction issues a redirect built from a user-supplied URL, the descriptors expose doCheck* methods, and the dashboard interpolates job and environment names into its views. Pinned to da7438f, which is what both the v2 and v2.4.0 tags resolve to today. Findings land under Security > Code scanning and do not fail the build. Signed-off-by: kurok <22548029+kurok@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #27.
CodeQL run with the jenkins-infra query pack rather than the generic Java one, so it looks for what plugins actually get wrong: unsafe Stapler bindings,
do*methods missing a permission check or CSRF protection, XSS through Jelly. The archetype ships this for every new plugin; this repository never had it.The plugin has exactly that surface:
BuildAddUrl.BuildUrlActionissues a redirect built from a user-supplied URLdoCheck*methodsPinned to
da7438f, which is what both thev2andv2.4.0tags resolve to today — I checked rather than copying the SHA from the issue. Findings land under Security → Code scanning and do not fail the build.Two things I cannot verify from here, stated rather than assumed
1. Whether the SARIF upload is accepted. The scan ends in
github/codeql-action/upload-sarif, which needs code scanning enabled on the repository.GET /code-scanning/alertsreturnsno analysis found, which is ambiguous — it means "nothing uploaded yet" and cannot distinguish that from "disabled". The repo is public, so it should be available; this PR's own run is the test. If it fails on the upload, that is a repository setting I do not have access to change (Settings → Code security → Code scanning), and I will say so rather than leaving a red check looking like a code problem.2. Whether the scan actually detects anything. A security scan that silently matches nothing is worse than no scan, because it reads as assurance. The issue prescribes the check: a throwaway PR adding a
do*method with no permission check, confirming it is flagged, then closed. I have not done that yet — I wanted the workflow itself proven to run first. I will do it on a separate short-lived branch so this PR contains only the workflow and master's history never carries a deliberately unsafe method.Also needs admin, from the issue
Settings → Code security: Code scanning, plus Secret scanning and Push protection while you are there — the release-credentials handling fixed in #11/#21 is precisely what push protection exists to catch.