Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -3,52 +3,55 @@
import hudson.model.Action;

import org.apache.commons.lang.StringUtils;
import org.kohsuke.stapler.export.Exported;

import java.util.ArrayList;
import java.util.List;
import java.util.regex.Pattern;

public class MavenDeploymentLinkerAction implements Action {

/*package*/ static class ArtifactVersion {
public static class ArtifactVersion {
private static final String SNAPSHOT_PATTERN = ".*-SNAPSHOT.*";
private static final Pattern p = Pattern.compile(SNAPSHOT_PATTERN);

private ArtifactVersion(String url) {
this.name = extractName(url);
this.url = normalize(url);
snapshot = p.matcher(url).matches();
this.snapshot = p.matcher(url).matches();
}

private final String url;
private boolean snapshot;
private String name;

private String extractName(String s) {
return s.substring(s.lastIndexOf('/') + 1, s.length());
}
private String normalize(String url) {
// JENKINS-9114 : Remove "dav:" when Maven uses webdav deployment
// JENKINS-9114 : Remove "dav:" when Maven uses webdav deployment
return StringUtils.removeStart(url, "dav:");
}

public boolean isSnapshot() {
return snapshot;
}
public String getName() {
return name;
}
public String getUrl() {
return url;
}
public String getText() {
StringBuilder textBuilder = new StringBuilder();
textBuilder.append("\n<li>");
textBuilder.append("<a href=\"" + url + "\">");
textBuilder.append(url.substring(url.lastIndexOf('/') + 1, url.length()));
textBuilder.append("</a>");
textBuilder.append("</li>\n");
return textBuilder.toString();

protected Object readResolve() {
if (name == null) {
name = extractName(url);
}
return this;
}
}

private List<ArtifactVersion> deployments = new ArrayList<ArtifactVersion>();

private transient String text;

@Deprecated
private transient boolean snapshot;

Expand All @@ -71,20 +74,6 @@ public String getUrlName() {
return "";
}

@Exported
public String getText() {
if (text == null) {
StringBuilder textBuilder = new StringBuilder();
textBuilder.append("<ul>");
for (ArtifactVersion artifact : deployments) {
textBuilder.append(artifact.getText());
}
textBuilder.append("</ul>");
text = textBuilder.toString();
}
return text;
}

public void addDeployment(String url) {
ArtifactVersion artifactVersion = new ArtifactVersion(url);
deployments.add(artifactVersion);
Expand All @@ -93,7 +82,7 @@ public void addDeployment(String url) {
/**
* @return list of all linked deployments
*/
/*package*/ List<ArtifactVersion> getDeployments() {
public List<ArtifactVersion> getDeployments() {
return deployments;
}
}
Original file line number Diff line number Diff line change
@@ -1,6 +1,11 @@
<?jelly escape-by-default='true'?>
<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
<t:summary icon="package.gif">
${%deployments}
${it.text}
<ul>
<j:forEach items="${it.deployments}" var="deployment">
<li><a href="${deployment.url}">${deployment.name}</a></li>
</j:forEach>
</ul>
</t:summary>
</j:jelly>
Original file line number Diff line number Diff line change
@@ -1,14 +1,24 @@
<?jelly escape-by-default='true'?>
<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
<j:if test="${it.hasLatestDeployments()}">
<table style="margin-top: 1em; margin-left:1em;">
<t:summary icon="package.gif">
${%latestDeployments}
${it.latestDeployments.text}
<ul>
<j:forEach items="${it.latestDeployments.deployments}" var="deployment">
<li><a href="${deployment.url}">${deployment.name}</a></li>
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This does not disallow URLs with javascript: scheme, so I expect there's still an XSS vulnerability here.

</j:forEach>
</ul>
<j:out value="${it.latestDeployments.text}"/>
</t:summary>
<j:if test="${it.hasLatestReleaseDeployments()}">
<t:summary icon="package.gif">
${%latestReleaseDeployments}
${it.latestReleaseDeployments.text}
<ul>
<j:forEach items="${it.latestReleaseDeployments.deployments}" var="deployment">
<li><a href="${deployment.url}">${deployment.name}</a></li>
</j:forEach>
</ul>
</t:summary>
</j:if>
</table>
Expand Down