From 59021b70146add475fa237fef8655e6cde6f1d15 Mon Sep 17 00:00:00 2001 From: Mark Waite Date: Fri, 10 Jul 2026 17:19:32 -0600 Subject: [PATCH 1/2] Do not write stack trace to system log for unauthorized API access Fixes #339 Advisory https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3745 with the change in https://github.com/jenkinsci/git-parameter-plugin/commit/496a59f698e5ada712dea1ebf980709f0040e394 adds a permission check that requires Item.BUILD permission in order to read the parameter values. It relies on the checkPermission() method to throw an exception. The exception is written to the Jenkins log. The unguarded call to checkPermission() is a relatively common technique, but a user reported that it dramatically increases the size of their system logs. Refer to issue: * https://github.com/jenkinsci/git-parameter-plugin/issues/339 Return an empty list instead of throwing an exception. Write a message and the exception to the logger of the class when the logging level is FINE. Changes the behavior of the API when the request does not have permission. The security fix caused the API to return: > "parameterDefinitions": [] The code in this commit returns: > "parameterDefinitions": [ > { > "_class": "net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition", > "defaultParameterValue": { > "_class": "net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterValue", > "value": "jdk-17.0.19" > }, > "description": "Choose tag to checkout", > "name": "PRIVATE_TAG", > "type": "GitParameterDefinition", > "allValueItems": { > "errors": [], > "values": [] > } > } > ] That means the default value for the parameter is now available to the read only user, when previously the default value was not available to the read only user. I'd like an opinion from the Jenkins security team before I merge this change, since the default value might be considered sensitive information. Testing done: * Confirmed that the stack trace is written to the Jenkins log by the latest release * Confirmed that the stack trace is not written to the Jenkins log by this change * Confirmed that the list of values is correctly not returned by this change * Noted that the default value is visible with this change --- .../plugins/gitparameter/GitParameterDefinition.java | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/main/java/net/uaznia/lukanus/hudson/plugins/gitparameter/GitParameterDefinition.java b/src/main/java/net/uaznia/lukanus/hudson/plugins/gitparameter/GitParameterDefinition.java index 2356d7f..feaa717 100644 --- a/src/main/java/net/uaznia/lukanus/hudson/plugins/gitparameter/GitParameterDefinition.java +++ b/src/main/java/net/uaznia/lukanus/hudson/plugins/gitparameter/GitParameterDefinition.java @@ -731,7 +731,15 @@ public ItemsErrorModel doFillValueItems(@AncestorInPath Job job, @QueryParameter if (job == null) { return ItemsErrorModel.EMPTY; } - job.checkPermission(Job.BUILD); + try { + job.checkPermission(Job.BUILD); + } catch (org.springframework.security.access.AccessDeniedException e) { + // Write the exception to the logger, not to the Jenkins log. + // + // https://github.com/jenkinsci/git-parameter-plugin/issues/339 + LOGGER.log(Level.FINE, job.getDisplayName() + " " + e.getMessage(), e); + return ItemsErrorModel.EMPTY; + } JobWrapper jobWrapper = JobWrapperFactory.createJobWrapper(job); From 83dee3560d1686f84a24c0832a1678a3ef60c2b9 Mon Sep 17 00:00:00 2001 From: Mark Waite Date: Sat, 11 Jul 2026 10:37:42 -0600 Subject: [PATCH 2/2] Guard the logging call to avoid work when not logging --- .../hudson/plugins/gitparameter/GitParameterDefinition.java | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/main/java/net/uaznia/lukanus/hudson/plugins/gitparameter/GitParameterDefinition.java b/src/main/java/net/uaznia/lukanus/hudson/plugins/gitparameter/GitParameterDefinition.java index feaa717..218be2e 100644 --- a/src/main/java/net/uaznia/lukanus/hudson/plugins/gitparameter/GitParameterDefinition.java +++ b/src/main/java/net/uaznia/lukanus/hudson/plugins/gitparameter/GitParameterDefinition.java @@ -737,7 +737,9 @@ public ItemsErrorModel doFillValueItems(@AncestorInPath Job job, @QueryParameter // Write the exception to the logger, not to the Jenkins log. // // https://github.com/jenkinsci/git-parameter-plugin/issues/339 - LOGGER.log(Level.FINE, job.getDisplayName() + " " + e.getMessage(), e); + if (LOGGER.isLoggable(Level.FINE)) { + LOGGER.log(Level.FINE, job.getDisplayName() + " " + e.getMessage(), e); + } return ItemsErrorModel.EMPTY; }