jenkinsci / jenkinsci/junit-attachments-plugin
AttachmentPublisher.getAttachmentPath does not taking care about to use only allowed file system characters
- Dominant language
- Java
- Stars
- 19
- Forks
- 45
- Avg merge
- 7h 50m
- Merged PRs (30d)
- 2
Description
### Jenkins and plugins versions report
junit-attachments-plugin version: 330.v25180b_263160
### What Operating System are you using (both controller, and any agents involved in the problem)?
Windows for controller and agents.
### Reproduction steps
In [AttachmentPublisher.getAttachmentPath](https://github.com/jenkinsci/junit-attachments-plugin/blob/25180b2631607ac1288f70c5e3fa5ef552094095/src/main/java/hudson/plugins/junitattachments/AttachmentPublisher.java#L61C4-L71C6) the [TestObject.safe](https://github.com/jenkinsci/junit-plugin/blob/095840ed8491084d8b8af6e2ed7c744c25856ade/src/main/java/hudson/tasks/test/TestObject.java#L415C5-L432C6) method will be used to replace unsafe url characters:
There are two problems with that:
1. Not all unsafe URL characters are actually replaced by that method, as I reported [here](https://github.com/jenkinsci/junit-plugin/issues/1211)
2. Even all unsafe URL characters are replaced, this does not mean that this is then also a valid file path. For example: while an "\*" is valid to use in an URL, it is not allowed to use it in a windows file name. Even if all unsafe URL characters are replaced, this does not mean that the result is a valid file path. For example, while "\*" is a valid character in a URL, it is not allowed in a Windows file name. When I try to enter "\*" as a file name, I get the following pop-up:
### Expected Results
All not allowed characters should be replaced (operating system dependent)
### Actual Results
Not all not allowed characters are replaced which leads to errors while parsing the test results.
Here is an example where we use parameterized tests that use invalid file path characters:
[AttachmentsTests.cs](https://github.com/user-attachments/files/25362910/AttachmentsTests.cs)
The related test report:
[TestResults.xml](https://github.com/user-attachments/files/25362802/TestResults.xml)
And finally the error when trying to add the results via
`junit keepProperties: true, skipPublishingChecks: true, stdioRetention: 'ALL', testDataPublishers: [attachments()], testResults: '*.xml'`
in jenkins:
When the test cases "\*" and "|" of `Can_Use_Invalid_File_Path_Signs_In_TestParameter ` will be removed, everything is fine.
### Anything else?
The provided sample is just for demonstrating the problem.
In real life we use tools like [Bogus](https://github.com/bchavez/Bogus) for generating fake data (to simulate user input and so on). This means any UTF‑8 character can be generated, and in our case, it is completely valid to have such characters appear in a test parameter.
### Are you interested in contributing a fix?
_No response_
Contributor guide
Research direction
Start with AttachmentPublisher.getAttachmentPath in src/main/java/hudson/plugins/junitattachments/AttachmentPublisher.java and compare its use of TestObject.safe in the linked junit-plugin source. Reproduce the attached invalid-path-character example on Windows, then verify that generated attachment paths remain valid for the operating system and that the test results parse successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- testing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100