CVE-2019-1003014

@@ -49,7 +49,7 @@ THE SOFTWARE.
                                      src="${imagesURL}/16x16/document_edit.gif"/>
                             </a>
                             <j:out value=" "/>
-                            <a href="removeConfig?id=${t.id}" onclick="return cfp_confirmDelete('${t.name}')">
+                            <a href="removeConfig?id=${t.id}" onclick="return cfp_confirmDelete(this)" data-confirm="${t.name}">
                                 <img width="16" height="16" title="${%remove script} ${t.name}"
                                      src="${imagesURL}/16x16/edit-delete.gif"/>
                             </a>
@@ -71,16 +71,15 @@ THE SOFTWARE.
                 </j:forEach>
             </table>
         </j:forEach>
-
     </div>
     <script>
-        function cfp_confirmDelete(name) {
-        if (confirm("Sure you want to delete ["+name+"]?")) {
-        return true;
-        }else{
-        return false;
-        }
+        function cfp_confirmDelete(anchor) {
+            var confirmMessage = anchor.getAttribute("data-confirm");
+            if (confirm("Sure you want to delete ["+confirmMessage+"]?")) {
+                return true;
+            }else{
+                return false;
+            }
         }
     </script>
-
-</j:jelly>
\ No newline at end of file
+</j:jelly>

@@ -47,7 +47,7 @@ THE SOFTWARE.
                                      src="${imagesURL}/16x16/document_edit.gif" />
                             </a>
                             <j:out value=" " />
-                            <a href="removeConfig?id=${t.id}" onclick="return cfp_confirmDelete('${t.name}')">
+                            <a href="removeConfig?id=${t.id}" onclick="return cfp_confirmDelete(this)" data-confirm="${t.name}">
                                 <img width="16" height="16" title="${%remove script} ${t.name}"
                                      src="${imagesURL}/16x16/edit-delete.gif" />
                             </a>
@@ -66,8 +66,9 @@ THE SOFTWARE.
     </div>
 
     <script>
-        function cfp_confirmDelete(name) {
-            if (confirm("Sure you want to delete ["+name+"]?")) {
+        function cfp_confirmDelete(anchor) {
+            var confirmMessage = anchor.getAttribute("data-confirm");
+            if (confirm("Sure you want to delete ["+confirmMessage+"]?")) {
                 return true;
             }else{
                 return false;

@@ -0,0 +1,112 @@
+package org.jenkinsci.plugins.configfiles;
+
+import com.gargoylesoftware.htmlunit.html.HtmlAnchor;
+import com.gargoylesoftware.htmlunit.html.HtmlForm;
+import com.gargoylesoftware.htmlunit.html.HtmlInput;
+import com.gargoylesoftware.htmlunit.html.HtmlPage;
+import com.gargoylesoftware.htmlunit.html.HtmlRadioButtonInput;
+import org.jenkinsci.plugins.configfiles.custom.CustomConfig;
+import org.junit.Rule;
+import org.junit.Test;
+import org.jvnet.hudson.test.Issue;
+import org.jvnet.hudson.test.JenkinsRule;
+
+import java.util.concurrent.atomic.AtomicReference;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.collection.IsCollectionWithSize.hasSize;
+import static org.hamcrest.collection.IsEmptyCollection.empty;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertThat;
+
+public class ConfigFilesSEC1253Test {
+
+    private static final String CONFIG_ID = "ConfigFilesTestId";
+
+    @Rule
+    public JenkinsRule j = new JenkinsRule();
+
+    @Test
+    @Issue("SECURITY-1253")
+    public void regularCaseStillWorking() throws Exception {
+        GlobalConfigFiles store = j.getInstance().getExtensionList(GlobalConfigFiles.class).get(GlobalConfigFiles.class);
+        assertNotNull(store);
+        assertThat(store.getConfigs(), empty());
+
+        JenkinsRule.WebClient wc = j.createWebClient();
+        HtmlPage createConfig = wc.goTo("configfiles/selectProvider");
+        HtmlRadioButtonInput groovyRadioButton = createConfig.getDocumentElement().getOneHtmlElementByAttribute("input", "value", "org.jenkinsci.plugins.configfiles.groovy.GroovyScript");
+        groovyRadioButton.click();
+        HtmlForm addConfigForm = createConfig.getFormByName("addConfig");
+
+        HtmlPage createGroovyConfig = j.submit(addConfigForm);
+        HtmlInput configIdInput = createGroovyConfig.getElementByName("config.id");
+        configIdInput.setValueAttribute(CONFIG_ID);
+
+        HtmlInput configNameInput = createGroovyConfig.getElementByName("config.name");
+        configNameInput.setValueAttribute("Regular name");
+
+        HtmlForm saveConfigForm = createGroovyConfig.getForms().stream()
+                .filter(htmlForm -> htmlForm.getActionAttribute().equals("saveConfig"))
+                .findFirst()
+                .orElseThrow(() -> new RuntimeException("No config with action [saveConfig] in that page"));
+        j.submit(saveConfigForm);
+
+        assertThat(store.getConfigs(), hasSize(1));
+
+        HtmlPage configFiles = wc.goTo("configfiles");
+        HtmlAnchor removeAnchor = configFiles.getDocumentElement().getOneHtmlElementByAttribute("a", "href", "removeConfig?id=" + CONFIG_ID);
+
+        AtomicReference<Boolean> confirmCalled = new AtomicReference<>(false);
+        wc.setConfirmHandler((page, s) -> {
+            confirmCalled.set(true);
+            return true;
+        });
+
+        assertThat(confirmCalled.get(), is(false));
+
+        removeAnchor.click();
+
+        assertThat(confirmCalled.get(), is(true));
+
+        assertThat(store.getConfigs(), empty());
+    }
+
+    @Test
+    @Issue("SECURITY-1253")
+    public void xssPrevention() throws Exception {
+        GlobalConfigFiles store = j.getInstance().getExtensionList(GlobalConfigFiles.class).get(GlobalConfigFiles.class);
+        assertNotNull(store);
+        assertThat(store.getConfigs(), empty());
+
+        CustomConfig config = new CustomConfig(CONFIG_ID, "GroovyConfig')+alert('asw", "comment", "content");
+        store.save(config);
+
+        assertThat(store.getConfigs(), hasSize(1));
+
+        JenkinsRule.WebClient wc = j.createWebClient();
+
+        HtmlPage configFiles = wc.goTo("configfiles");
+        HtmlAnchor removeAnchor = configFiles.getDocumentElement().getOneHtmlElementByAttribute("a", "href", "removeConfig?id=" + CONFIG_ID);
+
+        AtomicReference<Boolean> confirmCalled = new AtomicReference<>(false);
+        AtomicReference<Boolean> alertCalled = new AtomicReference<>(false);
+        wc.setConfirmHandler((page, s) -> {
+            confirmCalled.set(true);
+            return true;
+        });
+        wc.setAlertHandler((page, s) -> {
+            alertCalled.set(true);
+        });
+
+        assertThat(confirmCalled.get(), is(false));
+        assertThat(alertCalled.get(), is(false));
+
+        removeAnchor.click();
+
+        assertThat(confirmCalled.get(), is(true));
+        assertThat(alertCalled.get(), is(false));
+
+        assertThat(store.getConfigs(), empty());
+    }
+}