jenkinsci / jenkinsci/junit-plugin

Semicolons in test names cause 400 errors after the fix for SECURITY-1774 / CVE-2020-2160

Open
#216 2 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
87
Forks
351
Avg merge
1d 19h
Merged PRs (30d)
2

Description

Users receive "HTTP ERROR 400 Semicolons are not allowed in the request URI" when clicking on the test name if it contains a semicolon. This appears to be due to the change for [SECURITY-1774](https://www.jenkins.io/security/advisory/2020-03-25/). It is possible to bypass this check by setting ``allowSemicolonsInPath`` to ``true``, but probably not advised in the long run. Maybe this plugin should treat the semicolon (;) as a bad character when building up URLs here:
https://github.com/jenkinsci/junit-plugin/blob/d7d76b48c16b1fdf1354f0c146d8c799d0577164/src/main/java/hudson/tasks/test/TestObject.java#L423

Contributor guide

Open the contributing guide

Research direction

Read src/main/java/hudson/tasks/test/TestObject.java around line 423 and review how test names are used to build URLs after the SECURITY-1774 change. Reproduce the 400 response with a test name containing a semicolon, then verify that clicking such a test name no longer produces the invalid-request error.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
testing-qa
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.