jenkinsci / jenkinsci/junit-attachments-plugin

AttachmentPublisher.getAttachmentPath does not taking care about to use only allowed file system characters

Open
#201 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
19
Forks
45
Avg merge
7h 50m
Merged PRs (30d)
2

Description

### Jenkins and plugins versions report

junit-attachments-plugin version: 330.v25180b_263160

### What Operating System are you using (both controller, and any agents involved in the problem)?

Windows for controller and agents.

### Reproduction steps

In [AttachmentPublisher.getAttachmentPath](https://github.com/jenkinsci/junit-attachments-plugin/blob/25180b2631607ac1288f70c5e3fa5ef552094095/src/main/java/hudson/plugins/junitattachments/AttachmentPublisher.java#L61C4-L71C6) the [TestObject.safe](https://github.com/jenkinsci/junit-plugin/blob/095840ed8491084d8b8af6e2ed7c744c25856ade/src/main/java/hudson/tasks/test/TestObject.java#L415C5-L432C6) method will be used to replace unsafe url characters:

Image

There are two problems with that:

1. Not all unsafe URL characters are actually replaced by that method, as I reported [here](https://github.com/jenkinsci/junit-plugin/issues/1211)
2. Even all unsafe URL characters are replaced, this does not mean that this is then also a valid file path. For example: while an "\*" is valid to use in an URL, it is not allowed to use it in a windows file name. Even if all unsafe URL characters are replaced, this does not mean that the result is a valid file path. For example, while "\*" is a valid character in a URL, it is not allowed in a Windows file name. When I try to enter "\*" as a file name, I get the following pop-up:

Image

### Expected Results

All not allowed characters should be replaced (operating system dependent)

### Actual Results

Not all not allowed characters are replaced which leads to errors while parsing the test results.

Here is an example where we use parameterized tests that use invalid file path characters:
[AttachmentsTests.cs](https://github.com/user-attachments/files/25362910/AttachmentsTests.cs)

Image

The related test report:
[TestResults.xml](https://github.com/user-attachments/files/25362802/TestResults.xml)

And finally the error when trying to add the results via
`junit keepProperties: true, skipPublishingChecks: true, stdioRetention: 'ALL', testDataPublishers: [attachments()], testResults: '*.xml'`
in jenkins:
Image

When the test cases "\*" and "|" of `Can_Use_Invalid_File_Path_Signs_In_TestParameter ` will be removed, everything is fine.

### Anything else?

The provided sample is just for demonstrating the problem.

In real life we use tools like [Bogus](https://github.com/bchavez/Bogus) for generating fake data (to simulate user input and so on). This means any UTF‑8 character can be generated, and in our case, it is completely valid to have such characters appear in a test parameter.

### Are you interested in contributing a fix?

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with AttachmentPublisher.getAttachmentPath in src/main/java/hudson/plugins/junitattachments/AttachmentPublisher.java and compare its use of TestObject.safe in the linked junit-plugin source. Reproduce the attached invalid-path-character example on Windows, then verify that generated attachment paths remain valid for the operating system and that the test results parse successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.