CVE-2025-47884

@@ -42,6 +42,10 @@
             <groupId>org.jenkins-ci.plugins</groupId>
             <artifactId>plain-credentials</artifactId>
         </dependency>
+        <dependency>
+            <groupId>org.jenkins-ci.plugins.workflow</groupId>
+            <artifactId>workflow-api</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.jenkins-ci.plugins</groupId>
             <artifactId>credentials-binding</artifactId>

@@ -29,11 +29,18 @@
 import com.cloudbees.plugins.credentials.impl.BaseStandardCredentials;
 import edu.umd.cs.findbugs.annotations.CheckForNull;
 import edu.umd.cs.findbugs.annotations.NonNull;
+import hudson.EnvVars;
 import hudson.ExtensionList;
 import hudson.Util;
+import hudson.model.AbstractBuild;
+import hudson.model.Computer;
+import hudson.model.EnvironmentContributingAction;
+import hudson.model.EnvironmentContributor;
+import hudson.model.Job;
 import hudson.model.Run;
 import hudson.model.TaskListener;
 import hudson.util.FormValidation;
+import hudson.util.LogTaskListener;
 import hudson.util.Secret;
 import io.jenkins.plugins.oidc_provider.config.ClaimTemplate;
 import io.jenkins.plugins.oidc_provider.config.IdTokenConfiguration;
@@ -53,6 +60,7 @@
 import java.security.spec.RSAPublicKeySpec;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Base64;
 import java.util.Collections;
@@ -64,16 +72,22 @@
 import java.util.Set;
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.function.Consumer;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import java.util.stream.Collectors;
 import jenkins.model.Jenkins;
 import net.sf.json.JSONArray;
 import net.sf.json.JSONObject;
+import org.jenkinsci.plugins.workflow.flow.FlowExecutionOwner;
 import org.kohsuke.stapler.DataBoundSetter;
 import org.kohsuke.stapler.HttpResponses;
 import org.kohsuke.stapler.QueryParameter;
 import org.kohsuke.stapler.StaplerRequest2;
 
 public abstract class IdTokenCredentials extends BaseStandardCredentials {
 
+    private static final Logger LOGGER = Logger.getLogger(IdTokenCredentials.class.getName());
+
     private static final long serialVersionUID = 1;
 
     /**
@@ -192,7 +206,14 @@ RSAPublicKey publicKey() {
         Map<String, String> env;
         if (build != null) {
             try {
-                env = build.getEnvironment(TaskListener.NULL);
+                TaskListener listener = new LogTaskListener(Logger.getLogger(IdTokenCredentials.class.getName()), Level.INFO);
+                if (build instanceof FlowExecutionOwner.Executable feoe) {
+                    var feo = feoe.asFlowExecutionOwner();
+                    if (feo != null) {
+                        listener = feo.getListener();
+                    }
+                }
+                env = getEnvironment(build, listener);
             } catch (IOException | InterruptedException x) {
                 throw new RuntimeException(x);
             }
@@ -225,6 +246,45 @@ RSAPublicKey publicKey() {
             compact();
     }
 
+    /**
+     * Safer version of {@link Run#getEnvironment(TaskListener)} (and {@link Job#getEnvironment}) which prevents overrides.
+     */
+    private static EnvVars getEnvironment(Run<?, ?> build, TaskListener listener) throws IOException, InterruptedException {
+        var envs = new ArrayList<EnvVars>();
+        var c = Computer.currentComputer();
+        if (c != null) {
+            envs.add(c.getEnvironment());
+            envs.add(c.buildEnvironment(listener));
+        }
+        envs.add(new EnvVars("CLASSPATH", ""));
+        envs.add(build.getCharacteristicEnvVars()); // includes Job.getCharacteristicEnvVars
+        for (var ec : EnvironmentContributor.all()) {
+            var env = new EnvVars();
+            ec.buildEnvironmentFor(build.getParent(), env, listener);
+            envs.add(env);
+            env = new EnvVars();
+            ec.buildEnvironmentFor(build, env, listener);
+            envs.add(env);
+        }
+        if (!(build instanceof AbstractBuild)) {
+            for (var a : build.getActions(EnvironmentContributingAction.class)) {
+                var env = new EnvVars();
+                a.buildEnvironment(build, env);
+                envs.add(env);
+            }
+        }
+        var merged = new EnvVars();
+        envs.stream().flatMap(env -> env.entrySet().stream()).collect(Collectors.groupingBy(Map.Entry::getKey)).entrySet().stream().forEach(entry -> {
+            var values = entry.getValue().stream().map(Map.Entry::getValue).collect(Collectors.toSet());
+            if (values.size() == 1) {
+                merged.put(entry.getKey(), values.iterator().next());
+            } else {
+                listener.error("Refusing to consider conflicting values " + values + " of " + entry.getKey() + " for " + build);
+            }
+        });
+        return merged;
+    }
+
     protected @NonNull Issuer findIssuer() {
         Run<?, ?> context = build;
         if (context == null) {

@@ -30,15 +30,21 @@
 import com.cloudbees.plugins.credentials.CredentialsProvider;
 import com.cloudbees.plugins.credentials.CredentialsScope;
 import com.cloudbees.plugins.credentials.domains.Domain;
+import hudson.EnvVars;
+import hudson.model.EnvironmentContributor;
+import hudson.model.Job;
 import org.htmlunit.html.HtmlAnchor;
 import org.htmlunit.html.HtmlForm;
 import org.htmlunit.html.HtmlPage;
 import hudson.model.Result;
+import hudson.model.Run;
+import hudson.model.TaskListener;
 import io.jenkins.plugins.oidc_provider.config.BooleanClaimType;
 import io.jenkins.plugins.oidc_provider.config.IntegerClaimType;
 import io.jenkins.plugins.oidc_provider.config.StringClaimType;
 import io.jsonwebtoken.Claims;
 import io.jsonwebtoken.Jwts;
+import java.io.IOException;
 import java.math.BigInteger;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
@@ -47,6 +53,7 @@
 import java.util.List;
 import java.util.concurrent.atomic.AtomicReference;
 import jenkins.model.Jenkins;
+import static jenkins.test.RunMatchers.logContains;
 import org.junit.Test;
 import static org.hamcrest.Matchers.*;
 import static org.hamcrest.MatcherAssert.assertThat;
@@ -56,13 +63,19 @@
 import org.jenkinsci.plugins.workflow.support.actions.EnvironmentAction;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertTrue;
+import org.junit.ClassRule;
 import org.junit.Rule;
+import org.jvnet.hudson.test.BuildWatcher;
+import org.jvnet.hudson.test.Issue;
 import org.jvnet.hudson.test.JenkinsRule;
 import org.jvnet.hudson.test.JenkinsSessionRule;
 import org.jvnet.hudson.test.MockAuthorizationStrategy;
+import org.jvnet.hudson.test.TestExtension;
 
 public class IdTokenCredentialsTest {
 
+    @ClassRule public static final BuildWatcher bw = new BuildWatcher();
+
     @Rule public JenkinsSessionRule rr = new JenkinsSessionRule();
 
     @Test public void persistence() throws Throwable {
@@ -204,4 +217,58 @@ public class IdTokenCredentialsTest {
         });
     }
 
+    @Issue("SECURITY-3574")
+    @Test public void spoofedClaimsRunLevel() throws Throwable {
+        rr.then(r -> {
+            var c = new IdTokenStringCredentials(CredentialsScope.GLOBAL, "test", null);
+            CredentialsProvider.lookupStores(r.jenkins).iterator().next().addCredentials(Domain.global(), c);
+            var p = r.createProject(Folder.class, "dir").createProject(WorkflowJob.class, "p");
+            p.setDefinition(new CpsFlowDefinition("withCredentials([string(variable: 'TOK', credentialsId: 'test')]) {env.TOK = TOK}", true));
+            var b = r.buildAndAssertSuccess(p);
+            var idToken = b.getAction(EnvironmentAction.class).getEnvironment().get("TOK");
+            System.out.println(idToken);
+            var claims = Jwts.parserBuilder().
+                setSigningKey(c.publicKey()).
+                build().
+                parseClaimsJws(idToken).
+                getBody();
+            System.out.println(claims);
+            assertEquals(/* p.getAbsoluteUrl() */ "${JOB_URL}", claims.getSubject());
+            assertThat(b, logContains("Refusing to consider conflicting values"));
+        });
+    }
+    @SuppressWarnings("rawtypes") // design flaw in Jenkins core
+    @TestExtension("spoofedClaimsRunLevel") public static final class RunSpoofer extends EnvironmentContributor {
+        @Override public void buildEnvironmentFor(Run r, EnvVars envs, TaskListener listener) throws IOException, InterruptedException {
+            envs.put("JOB_URL", "https://bogus.com/");
+        }
+    }
+
+    @Issue("SECURITY-3574")
+    @Test public void spoofedClaimsJobLevel() throws Throwable {
+        rr.then(r -> {
+            var c = new IdTokenStringCredentials(CredentialsScope.GLOBAL, "test", null);
+            CredentialsProvider.lookupStores(r.jenkins).iterator().next().addCredentials(Domain.global(), c);
+            var p = r.createProject(Folder.class, "dir").createProject(WorkflowJob.class, "p");
+            p.setDefinition(new CpsFlowDefinition("withCredentials([string(variable: 'TOK', credentialsId: 'test')]) {env.TOK = TOK}", true));
+            var b = r.buildAndAssertSuccess(p);
+            var idToken = b.getAction(EnvironmentAction.class).getEnvironment().get("TOK");
+            System.out.println(idToken);
+            var claims = Jwts.parserBuilder().
+                setSigningKey(c.publicKey()).
+                build().
+                parseClaimsJws(idToken).
+                getBody();
+            System.out.println(claims);
+            assertEquals(/* p.getAbsoluteUrl() */ "${JOB_URL}", claims.getSubject());
+            assertThat(b, logContains("Refusing to consider conflicting values"));
+        });
+    }
+    @SuppressWarnings("rawtypes") // design flaw in Jenkins core
+    @TestExtension("spoofedClaimsJobLevel") public static final class JobSpoofer extends EnvironmentContributor {
+        @Override public void buildEnvironmentFor(Job j, EnvVars envs, TaskListener listener) throws IOException, InterruptedException {
+            envs.put("JOB_URL", "https://bogus.com/");
+        }
+    }
+
 }