[JENKINS-14655] allow gerrit trigger plugin to execute job on jenkins only if the author/commiter appears in a whitelist

Today, if you set a job in a public Jenkins instance to run on each gerrit patch from the community, it might be used by malicious user to run un-authorized code or malicious code on the jenkins server.

(for e.g. sending a patch to 'rm -rf... ')

also, it might be the jenkins server can't handle load of multiple patches and you want to restrict the job for specific users only.

one of the ways of handling this is maintaining a whitelist of authors that can trigger a jenkins job (once they send a patch).

so i suggest that the gerrit trigger plugin will be able to check if the author of the specific commit that triggered the job, match a whitelist that will be in a file (can be in the git repo itself).

if the author doesn't exist, the job can abort/fail.

---
Originally reported by eedri, imported from: allow gerrit trigger plugin to execute job on jenkins only if the author/commiter appears in a whitelist

• assignee: rsandell
  
• status: Open
  
• priority: Major
  
• component(s): gerrit-trigger-plugin
  
• resolution: Unresolved
  
• votes: 1
  
• watchers: 3
  
• imported: 2025-12-06
  

Today, if you set a job in a public Jenkins instance to run on each gerrit patch from the community, it might be used by malicious user to run un-authorized code or malicious code on the jenkins server. 

(for e.g. sending a patch to 'rm -rf... ')


also, it might be the jenkins server can't handle load of multiple patches and you want to restrict the job for specific users only.


one of the ways of handling this is maintaining a whitelist of authors that can trigger a jenkins job (once they send a patch).


so i suggest that the gerrit trigger plugin will be able to check if the author of the specific commit that triggered the job, match a whitelist that will be in a file (can be in the git repo itself).


if the author doesn't exist, the job can abort/fail. 

The issue identifies the gerrit-trigger-plugin component but names no source files, tests, or entry points. Start by locating the trigger configuration and commit-author handling, then determine how a whitelist should be stored and how unmatched authors should abort or fail the job. Done means matching authors can trigger jobs while non-matching authors cannot.

Written by the indexing model from the issue text.