CVE-2025-64131

@@ -0,0 +1,16 @@
+package org.jenkinsci.plugins.saml;
+
+import hudson.ExtensionPoint;
+import org.pac4j.saml.replay.ReplayCacheProvider;
+
+/**
+ * {@link ReplayCacheProvider} being an interface suggests that there can be different providers, so this abstraction
+ * will allow to switch to another provider implementation if needed.
+ */
+public interface JenkinsReplayCacheProvider extends ExtensionPoint {
+
+    /**
+     * Returns the {@link ReplayCacheProvider} to be used by {@link JenkinsSAML2Client}
+     */
+    ReplayCacheProvider getProvider();
+}

@@ -0,0 +1,43 @@
+package org.jenkinsci.plugins.saml;
+
+import hudson.ExtensionList;
+import java.util.logging.Logger;
+import org.pac4j.saml.client.SAML2Client;
+import org.pac4j.saml.config.SAML2Configuration;
+import org.pac4j.saml.replay.InMemoryReplayCacheProvider;
+import org.pac4j.saml.replay.ReplayCacheProvider;
+
+/**
+ * This override of the base {@link SAML2Client} is needed to fix SECURITY-3613, by setting
+ * up a replay cache which is static to all client instances.
+ */
+public class JenkinsSAML2Client extends SAML2Client {
+
+    private static final Logger LOGGER = Logger.getLogger(JenkinsSAML2Client.class.getName());
+
+    static final ReplayCacheProvider REPLAY_CACHE = getProvider();
+
+    public JenkinsSAML2Client(SAML2Configuration config) {
+        super(config);
+    }
+
+    @Override
+    protected void initSAMLReplayCache(boolean forceReinit) {
+        replayCache = REPLAY_CACHE;
+    }
+
+    private static ReplayCacheProvider getProvider() {
+        var providers = ExtensionList.lookup(JenkinsReplayCacheProvider.class);
+        if (providers.isEmpty()) {
+            // Default if no extension is registered
+            return new InMemoryReplayCacheProvider();
+        }
+        if (providers.size() > 1) {
+            LOGGER.fine(() -> String.format(
+                    "There is more than one JenkinsReplayCacheProvider extension registered. "
+                            + "Picking [%s] as it's first one in the extensions list.",
+                    providers.get(0).getClass().getName()));
+        }
+        return providers.get(0).getProvider();
+    }
+}

@@ -168,7 +168,7 @@ protected SAML2Client createSAML2Client() {
         config.setServiceProviderMetadataResource(new SamlFileResource(SamlSecurityRealm.getSPMetadataFilePath()));
         // Apply all configured property executions to the configuration
         propertyExecutions.forEach(property -> property.customizeConfiguration(config));
-        SAML2Client saml2Client = new SAML2Client(config);
+        SAML2Client saml2Client = new JenkinsSAML2Client(config);
         saml2Client.setCallbackUrl(samlPluginConfig.getConsumerServiceUrl());
         saml2Client.setCallbackUrlResolver(new NoParameterCallbackUrlResolver());
         saml2Client.setStateGenerator(new RefererStateGenerator());

@@ -0,0 +1,43 @@
+package org.jenkinsci.plugins.saml;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.instanceOf;
+
+import org.junit.jupiter.api.Test;
+import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.junit.jupiter.WithJenkins;
+import org.pac4j.saml.config.SAML2Configuration;
+import org.pac4j.saml.replay.InMemoryReplayCacheProvider;
+
+/**
+ * Test to verify that the default InMemoryReplayCacheProvider is used
+ * when no JenkinsReplayCacheProvider extension is registered.
+ * This test validates the default behavior in the SECURITY-3613 fix.
+ */
+@WithJenkins
+class JenkinsReplayCacheProviderDefaultTest {
+
+    @Test
+    void testDefaultReplayCacheProviderIsUsed(JenkinsRule jenkinsRule) {
+        SAML2Configuration config = new SAML2Configuration();
+        JenkinsSAML2Client client = new JenkinsSAML2Client(config);
+        client.setCallbackUrl("http://localhost");
+        setKeyStore(config);
+        client.init();
+        assertThat(
+                "Default InMemoryReplayCacheProvider should be used when no extension is registered",
+                JenkinsSAML2Client.REPLAY_CACHE,
+                instanceOf(InMemoryReplayCacheProvider.class));
+    }
+
+    static void setKeyStore(SAML2Configuration config) {
+        BundleKeyStore keyStore = new BundleKeyStore();
+        if (!keyStore.isValid()) {
+            keyStore.init();
+        }
+        config.setKeystorePath(keyStore.getKeystorePath());
+        config.setKeystorePassword(keyStore.getKsPassword());
+        config.setPrivateKeyPassword(keyStore.getKsPkPassword());
+        config.setKeyStoreAlias(keyStore.getKsPkAlias());
+    }
+}

@@ -0,0 +1,58 @@
+package org.jenkinsci.plugins.saml;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.instanceOf;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import org.junit.jupiter.api.Test;
+import org.jvnet.hudson.test.JenkinsRule;
+import org.jvnet.hudson.test.TestExtension;
+import org.jvnet.hudson.test.junit.jupiter.WithJenkins;
+import org.pac4j.saml.config.SAML2Configuration;
+import org.pac4j.saml.replay.InMemoryReplayCacheProvider;
+import org.pac4j.saml.replay.ReplayCacheProvider;
+
+/**
+ * Test for the JenkinsReplayCacheProvider extension point functionality.
+ * This test validates SECURITY-3613 fix by ensuring custom replay cache providers
+ * are properly loaded and used by JenkinsSAML2Client.
+ */
+@WithJenkins
+class JenkinsReplayCacheProviderTest {
+
+    @Test
+    void testCustomReplayCacheProviderIsUsed(JenkinsRule jenkinsRule) {
+        SAML2Configuration config = new SAML2Configuration();
+        JenkinsSAML2Client client = new JenkinsSAML2Client(config);
+        client.setCallbackUrl("http://localhost");
+        BundleKeyStore keyStore = new BundleKeyStore();
+        JenkinsReplayCacheProviderDefaultTest.setKeyStore(config);
+        client.init();
+        assertThat(
+                "Custom replay cache provider should be used",
+                JenkinsSAML2Client.REPLAY_CACHE,
+                instanceOf(TestReplayCacheProvider.class));
+        assertTrue(
+                TestReplayCacheProvider.wasProviderCalled,
+                "Test replay cache provider getProvider() method should have been called");
+    }
+
+    @TestExtension
+    public static class TestJenkinsReplayCacheProvider implements JenkinsReplayCacheProvider {
+
+        @Override
+        public ReplayCacheProvider getProvider() {
+            return new TestReplayCacheProvider();
+        }
+    }
+
+    public static class TestReplayCacheProvider extends InMemoryReplayCacheProvider {
+
+        static boolean wasProviderCalled = false;
+
+        public TestReplayCacheProvider() {
+            super();
+            wasProviderCalled = true;
+        }
+    }
+}