jenkinsci / jenkinsci/junit-plugin
Semicolons in test names cause 400 errors after the fix for SECURITY-1774 / CVE-2020-2160
- Dominant language
- Java
- Stars
- 87
- Forks
- 351
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 2
Description
Users receive "HTTP ERROR 400 Semicolons are not allowed in the request URI" when clicking on the test name if it contains a semicolon. This appears to be due to the change for [SECURITY-1774](https://www.jenkins.io/security/advisory/2020-03-25/). It is possible to bypass this check by setting ``allowSemicolonsInPath`` to ``true``, but probably not advised in the long run. Maybe this plugin should treat the semicolon (;) as a bad character when building up URLs here:
https://github.com/jenkinsci/junit-plugin/blob/d7d76b48c16b1fdf1354f0c146d8c799d0577164/src/main/java/hudson/tasks/test/TestObject.java#L423
Contributor guide
Research direction
Read src/main/java/hudson/tasks/test/TestObject.java around line 423 and review how test names are used to build URLs after the SECURITY-1774 change. Reproduce the 400 response with a test name containing a semicolon, then verify that clicking such a test name no longer produces the invalid-request error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- testing-qa
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100