CVE-2024-28149

@@ -1,15 +1,22 @@
 package htmlpublisher;
 
-import java.io.File;
-import java.io.IOException;
-import java.nio.charset.StandardCharsets;
-import java.util.Objects;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
+import com.infradna.tool.bridge_method_injector.WithBridgeMethods;
 import edu.umd.cs.findbugs.annotations.NonNull;
-import javax.servlet.ServletException;
-
+import hudson.Extension;
+import hudson.FilePath;
+import hudson.Util;
+import hudson.model.AbstractDescribableImpl;
+import hudson.model.Action;
+import hudson.model.AbstractItem;
+import hudson.model.Run;
+import hudson.model.DirectoryBrowserSupport;
+import hudson.model.Job;
+import hudson.model.ProminentProjectAction;
+import hudson.model.AbstractBuild;
+import hudson.model.InvisibleAction;
+import hudson.model.Descriptor;
+import hudson.util.HttpResponses;
+import jenkins.model.RunAction2;
 import org.apache.commons.codec.binary.Hex;
 import org.apache.commons.lang.StringUtils;
 import org.kohsuke.accmod.Restricted;
@@ -20,23 +27,15 @@
 import org.kohsuke.stapler.StaplerResponse;
 import org.owasp.encoder.Encode;
 
-import com.infradna.tool.bridge_method_injector.WithBridgeMethods;
+import javax.servlet.ServletException;
+import java.io.File;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Objects;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
-import hudson.Extension;
-import hudson.FilePath;
-import hudson.Util;
-import hudson.model.AbstractBuild;
-import hudson.model.AbstractDescribableImpl;
-import hudson.model.AbstractItem;
-import hudson.model.Action;
-import hudson.model.Descriptor;
-import hudson.model.DirectoryBrowserSupport;
-import hudson.model.InvisibleAction;
-import hudson.model.Job;
-import hudson.model.ProminentProjectAction;
-import hudson.model.Run;
-import hudson.util.HttpResponses;
-import jenkins.model.RunAction2;
+import static hudson.Functions.htmlAttributeEscape;
 
 /**
  * A representation of an HTML directory to archive and publish.
@@ -48,7 +47,7 @@ public class HtmlPublisherTarget extends AbstractDescribableImpl<HtmlPublisherTa
     /**
      * The name of the report to display for the build/project, such as "Code Coverage"
      */
-    private final String reportName;
+    private String reportName;
 
     /**
      * The path to the HTML report directory relative to the workspace.
@@ -183,15 +182,8 @@ public void setReportTitles(String reportTitles) {
         this.reportTitles = StringUtils.trim(reportTitles);
     }
 
-    /**
-     * Actually not safe, this allowed directory traversal (SECURITY-784).
-     * @return Returns a string with replaced whitespaces by underscores.
-     */
-    private String getLegacySanitizedName() {
-        String safeName = this.reportName;
-        safeName = safeName.replace(" ", "_");
-        return safeName;
-    }
+    //Add this for testing purposes
+    public void setReportName(String reportName) {this.reportName = StringUtils.trim(reportName);}
 
     public String getSanitizedName() {
         return sanitizeReportName(this.reportName, getEscapeUnderscores());
@@ -313,11 +305,6 @@ protected File dir() {
                 if (run != null) {
                     File javadocDir = getBuildArchiveDir(run);
 
-                    if (!javadocDir.exists()) {
-                        javadocDir = getBuildArchiveDir(run, getLegacySanitizedName());
-                    }
-                    // TODO not sure about this change
-
                     if (javadocDir.exists()) {
                         for (HTMLBuildAction a : run.getActions(HTMLBuildAction.class)) {
                             if (a.getHTMLTarget().getReportName().equals(getHTMLTarget().getReportName())) {
@@ -329,15 +316,7 @@ protected File dir() {
                 }
             }
 
-            // SECURITY-784: prefer safe over legacy, but if neither exists, return safe dir
             File projectArchiveDir = getProjectArchiveDir(this.project);
-            if (projectArchiveDir.exists()) {
-                return projectArchiveDir;
-            }
-            File legacyProjectArchiveDir = getProjectArchiveDir(this.project, getLegacySanitizedName());
-            if (legacyProjectArchiveDir.exists()) {
-                return legacyProjectArchiveDir;
-            }
             return projectArchiveDir;
         }
 
@@ -440,15 +419,7 @@ public String getBackToUrl() {
 
         @Override
         protected File dir() {
-            // SECURITY-784: prefer safe over legacy, but if neither exists, return safe dir
             File buildArchiveDir = getBuildArchiveDir(this.build);
-            if (buildArchiveDir.exists()) {
-                return buildArchiveDir;
-            }
-            File legacyBuildArchiveDir = getBuildArchiveDir(this.build, getLegacySanitizedName());
-            if (legacyBuildArchiveDir.exists()) {
-                return legacyBuildArchiveDir;
-            }
             return buildArchiveDir;
         }
 

@@ -0,0 +1,74 @@
+package htmlpublisher;
+
+import hudson.model.FreeStyleProject;
+import org.junit.Assert;
+import org.junit.Rule;
+import org.junit.Test;
+import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.recipes.LocalData;
+
+import java.io.File;
+
+import static hudson.Functions.isWindows;
+import static org.junit.Assume.assumeFalse;
+
+public class Security3301Test {
+
+    @Rule
+    public JenkinsRule j = new JenkinsRule();
+
+    @Test
+    @LocalData
+    public void security3301sanitizeTest() throws Exception {
+
+
+        // Skip on windows
+        assumeFalse(isWindows());
+
+        FreeStyleProject job = j.jenkins.getItemByFullName("testJob", FreeStyleProject.class);
+
+        Assert.assertTrue(new File(job.getRootDir(), "htmlreports/HTML_20Report").exists());
+
+        j.buildAndAssertSuccess(job);
+
+        changeJobReportName(job,"HTML_20Report/javascript:alert(1)");
+
+        job.save();
+
+        j.buildAndAssertSuccess(job);
+
+        HtmlPublisherTarget.HTMLAction action = job.getAction(HtmlPublisherTarget.HTMLAction.class);
+        Assert.assertNotNull(action);
+
+        //Check that the report name is escaped for the Url
+        Assert.assertEquals("HTML_20Report/javascript:alert(1)", action.getHTMLTarget().getReportName());
+        Assert.assertEquals("HTML_5f20Report_2fjavascript_3aalert_281_29", action.getUrlName());
+
+        Assert.assertTrue(new File(job.getRootDir(), "htmlreports/HTML_5f20Report_2fjavascript_3aalert_281_29").exists());
+
+        FreeStyleProject anotherJob = j.jenkins.getItemByFullName("anotherJob", FreeStyleProject.class);
+
+        Assert.assertTrue(new File(anotherJob.getRootDir(), "htmlreports/HTML_20Report").exists());
+
+        j.buildAndAssertSuccess(anotherJob);
+
+        changeJobReportName(job,"../../anotherJob/htmlreports/HTML_20Report");
+
+        job.save();
+
+        //Check that the build reports is not from the new job (anotherJob)
+        Assert.assertEquals("../../anotherJob/htmlreports/HTML_20Report", action.getHTMLTarget().getReportName());
+        Assert.assertEquals("_2e_2e_2f_2e_2e_2fanotherJob_2fhtmlreports_2fHTML_5f20Report", action.getUrlName());
+        Assert.assertFalse(new File(job.getRootDir(), "htmlreports/_2e_2e_2f_2e_2e_2fanotherJob_2fhtmlreports_2fHTML_5f20Report/test.txt").exists());
+
+    }
+
+    public void changeJobReportName(FreeStyleProject job, String newName) {
+        for (Object publisher : job.getPublishersList()) {
+            if (publisher instanceof HtmlPublisher) {
+                HtmlPublisher existingPublishHTML = (HtmlPublisher) publisher;
+                existingPublishHTML.getReportTargets().get(0).setReportName(newName);
+            }
+        }
+    }
+}

@@ -24,15 +24,7 @@ public void security784upgradeTest() throws Exception {
 
         Assert.assertTrue(new File(job.getRootDir(), "htmlreports/foo!!!!bar/index.html").exists());
 
-        HtmlPublisherTarget.HTMLAction action = job.getAction(HtmlPublisherTarget.HTMLAction.class);
-        Assert.assertNotNull(action);
-        Assert.assertEquals("foo!!!!bar", action.getHTMLTarget().getReportName());
-        Assert.assertEquals("foo!!!!bar", action.getUrlName()); // legacy
-
         JenkinsRule.WebClient client = j.createWebClient();
-        HtmlPage page = client.getPage(job, "foo!!!!bar/index.html");
-        String text = page.getWebResponse().getContentAsString();
-        Assert.assertEquals("Sun Mar 25 15:42:10 CEST 2018", text.trim());
 
         job.getBuildersList().clear();
         String newDate = new Date().toString();
@@ -44,16 +36,13 @@ public void security784upgradeTest() throws Exception {
 
         Assert.assertTrue(new File(job.getRootDir(), "htmlreports/foo_21_21_21_21bar/index.html").exists());
 
-        action = job.getAction(HtmlPublisherTarget.HTMLAction.class);
+        HtmlPublisherTarget.HTMLAction action = job.getAction(HtmlPublisherTarget.HTMLAction.class);
         Assert.assertNotNull(action);
         Assert.assertEquals("foo!!!!bar", action.getHTMLTarget().getReportName());
         Assert.assertEquals("foo_21_21_21_21bar", action.getUrlName()); // new
 
-        text = client.goTo("job/thejob/foo_21_21_21_21bar/index.html").getWebResponse().getContentAsString();
+        String text = client.goTo("job/thejob/foo_21_21_21_21bar/index.html").getWebResponse().getContentAsString();
         Assert.assertEquals(newDate, text.trim());
-
-        // leftovers from legacy naming
-        Assert.assertTrue(new File(job.getRootDir(), "htmlreports/foo!!!!bar/index.html").exists());
     }
 
     @Test

@@ -0,0 +1,39 @@
+<?xml version='1.1' encoding='UTF-8'?>
+<project>
+  <actions/>
+  <description></description>
+  <keepDependencies>false</keepDependencies>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <canRoam>true</canRoam>
+  <disabled>false</disabled>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <triggers/>
+  <concurrentBuild>false</concurrentBuild>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>echo &quot;Test999&quot; &gt; test.txt</command>
+      <configuredLocalRules/>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers>
+    <htmlpublisher.HtmlPublisher plugin="htmlpublisher@1.33-SNAPSHOT">
+      <reportTargets>
+        <htmlpublisher.HtmlPublisherTarget>
+          <reportName>HTML Report</reportName>
+          <reportDir></reportDir>
+          <reportFiles>test.txt</reportFiles>
+          <alwaysLinkToLastBuild>false</alwaysLinkToLastBuild>
+          <reportTitles></reportTitles>
+          <keepAll>false</keepAll>
+          <allowMissing>false</allowMissing>
+          <includes>**/*</includes>
+          <escapeUnderscores>true</escapeUnderscores>
+          <useWrapperFileDirectly>true</useWrapperFileDirectly>
+        </htmlpublisher.HtmlPublisherTarget>
+      </reportTargets>
+    </htmlpublisher.HtmlPublisher>
+  </publishers>
+  <buildWrappers/>
+</project>
\ No newline at end of file

@@ -0,0 +1,141 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
+"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+
+<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
+<head>
+<meta http-equiv="Content-Type" content="text/html" />
+<!-- CSS Tabs is licensed under Creative Commons Attribution 3.0 - http://creativecommons.org/licenses/by/3.0/ -->
+<style type="text/css">
+
+body {
+font: 100% verdana, arial, sans-serif;
+background-color: #fff;
+}
+
+/* begin css tabs */
+
+ul#tabnav { /* general settings */
+text-align: left; /* set to left, right or center */
+margin: 8px 0 0 0; /* set margins as desired */
+font: bold 11px verdana, arial, sans-serif; /* set font as desired */
+border-bottom: 1px solid #6c6; /* set border COLOR as desired */
+list-style-type: none;
+padding: 3px 10px 0px 10px;
+}
+
+ul#tabnav li { /* do not change */
+display: inline-block;
+}
+
+ul#tabnav li.selected { /* settings for selected tab */
+border-bottom: 1px solid #fff; /* set border color to page background color */
+background-color: #fff; /* set background color to match above border color */
+}
+
+
+ul#tabnav li { /* settings for all tab links */
+padding: 3px 4px;
+border: 1px solid #6c6; /* set border COLOR as desired; usually matches border color specified in #tabnav */
+border-bottom: 1px solid #cfc;
+background-color: #cfc; /* set unselected tab background color as desired */
+color: #666; /* set unselected tab link color as desired */
+margin-right: 0px; /* set additional spacing between tabs as desired */
+text-decoration: none;
+cursor: pointer;
+}
+
+ul#tabnav li:hover { /* settings for hover effect */
+background: #afa; /* set desired hover color */
+}
+
+/* end css tabs */
+
+/* FF 100% height iframe */
+html, body, div, iframe { margin:0; padding:0; }
+iframe { display:block; width:100%; border:none; }
+
+h1
+{
+    display: inline;
+    float: left;
+    font-size: small;
+    margin: 0;
+    padding: 0 10px;
+}
+
+h2
+{
+    display: inline;
+    float: right;
+    font-size: small;
+    margin: 0;
+    padding: 0 10px;
+}
+
+</style>
+
+<script type="text/javascript">
+function updateBody(tabId, page) {
+    document.getElementById(selectedTab).setAttribute("class", "unselected");
+    tab = document.getElementById(tabId)
+    tab.setAttribute("class", "selected");
+    selectedTab = tabId;
+    iframe = document.getElementById("myframe");
+    iframe.src = encodeURIComponent(tab.getAttribute("value")).replace(/%2F/g, '/');
+}
+function init(tabId){
+	updateBody(tabId);
+	updateViewport();
+	
+	window.onresize = updateViewport;
+}
+
+function updateViewport(){
+	 var viewportheight;
+
+	 // the more standards compliant browsers (mozilla/netscape/opera/IE7) use window.innerWidth and window.innerHeight
+
+	 if (typeof window.innerWidth != 'undefined')
+	 {
+	      viewportheight = window.innerHeight
+	 }
+
+	// IE6 in standards compliant mode (i.e. with a valid doctype as the first line in the document)
+
+	 else if (typeof document.documentElement != 'undefined'
+	     && typeof document.documentElement.clientWidth !=
+	     'undefined' && document.documentElement.clientWidth != 0)
+	 {
+	       viewportheight = document.documentElement.clientHeight
+	 }
+	// older versions of IE
+	 else
+	 { 
+	       viewportheight = document.getElementsByTagName('body')[0].clientHeight
+	 }
+	
+	iframe = document.getElementById("myframe");
+	iframe.style.height = (viewportheight-30)+'px';
+}
+var selectedTab = "tab1"
+</script>
+
+</head>
+
+<body onload="init('tab1');">
+
+<h1><a id="hudson_link" href="#"></a></h1>
+<h2><a id="zip_link" href="#">Zip</a></h2>
+
+<ul id="tabnav">
+<li id="tab1" class="unselected" onclick="updateBody('tab1');" value="test.txt">test</li>
+<script type="text/javascript">document.getElementById("hudson_link").innerHTML="Back to anotherJob";</script>
+<script type="text/javascript">document.getElementById("hudson_link").onclick = function() { history.go(-1); return false; };</script>
+<script type="text/javascript">document.getElementById("zip_link").href="*zip*/HTML_20Report.zip";</script>
+</ul>
+<div>
+<iframe id="myframe" height="100%" width="100%" frameborder="0"></iframe>
+</div>
+
+</body>
+</html>

@@ -0,0 +1 @@
+Test999

@@ -0,0 +1,39 @@
+<?xml version='1.1' encoding='UTF-8'?>
+<project>
+  <description></description>
+  <keepDependencies>false</keepDependencies>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <canRoam>true</canRoam>
+  <disabled>false</disabled>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <triggers/>
+  <concurrentBuild>false</concurrentBuild>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>touch &quot;javascript:alert(1)&quot;
+      </command>
+      <configuredLocalRules/>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers>
+    <htmlpublisher.HtmlPublisher plugin="htmlpublisher@1.33-SNAPSHOT">
+      <reportTargets>
+        <htmlpublisher.HtmlPublisherTarget>
+          <reportName>HTML Report</reportName>
+          <reportDir></reportDir>
+          <reportFiles>index.html</reportFiles>
+          <alwaysLinkToLastBuild>false</alwaysLinkToLastBuild>
+          <reportTitles></reportTitles>
+          <keepAll>false</keepAll>
+          <allowMissing>false</allowMissing>
+          <includes>**/*</includes>
+          <escapeUnderscores>true</escapeUnderscores>
+          <useWrapperFileDirectly>true</useWrapperFileDirectly>
+        </htmlpublisher.HtmlPublisherTarget>
+      </reportTargets>
+    </htmlpublisher.HtmlPublisher>
+  </publishers>
+  <buildWrappers/>
+</project>
\ No newline at end of file

@@ -0,0 +1,64 @@
+<script type="text/javascript">
+function updateBody(tabId, page) {
+    document.getElementById(selectedTab).setAttribute("class", "unselected");
+    tab = document.getElementById(tabId)
+    tab.setAttribute("class", "selected");
+    selectedTab = tabId;
+    iframe = document.getElementById("myframe");
+    iframe.src = encodeURIComponent(tab.getAttribute("value")).replace(/%2F/g, '/');
+}
+function init(tabId){
+        updateBody(tabId);
+        updateViewport();
+
+        window.onresize = updateViewport;
+}
+
+function updateViewport(){
+         var viewportheight;
+
+         // the more standards compliant browsers (mozilla/netscape/opera/IE7) use window.innerWidth and window.innerHeight
+
+         if (typeof window.innerWidth != 'undefined')
+         {
+              viewportheight = window.innerHeight
+         }
+
+        // IE6 in standards compliant mode (i.e. with a valid doctype as the first line in the document)
+
+         else if (typeof document.documentElement != 'undefined'
+             && typeof document.documentElement.clientWidth !=
+             'undefined' && document.documentElement.clientWidth != 0)
+         {
+               viewportheight = document.documentElement.clientHeight
+         }
+        // older versions of IE
+         else
+         {
+               viewportheight = document.getElementsByTagName('body')[0].clientHeight
+         }
+
+        iframe = document.getElementById("myframe");
+        iframe.style.height = (viewportheight-30)+'px';
+}
+var selectedTab = "tab1"
+</script>
+
+</head>
+
+<body onload="init('tab1');">
+
+<h1><a id="hudson_link" href="#"></a></h1>
+<h2><a id="zip_link" href="#">Zip</a></h2>
+
+<ul id="tabnav">
+    <script type="text/javascript">document.getElementById("hudson_link").innerHTML="Back to testJob";</script>
+    <script type="text/javascript">document.getElementById("hudson_link").onclick = function() { history.go(-1); return false; };</script>
+    <script type="text/javascript">document.getElementById("zip_link").href="*zip*/HTML_5f20Report_2fjavascript_3aalert_281_29.zip";</script>
+</ul>
+<div>
+    <iframe id="myframe" height="100%" width="100%" frameborder="0"></iframe>
+</div>
+
+</body>
+</html>
\ No newline at end of file