Skip to content
This repository was archived by the owner on Nov 19, 2024. It is now read-only.

Commit 96386f9

Browse files
centic9centic9
committed
[SECURITY-3061]
(cherry picked from commit d208953)
1 parent 79b76d3 commit 96386f9

File tree

12 files changed

+109
-59
lines changed

12 files changed

+109
-59
lines changed

‎src/main/java/hudson/plugins/jacoco/report/AbstractReport.java

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,18 @@ public String getName() {
3131
}
3232

3333
public void setName(String name) {
34-
this.name = name;
34+
this.name = sanitizeName(name);
35+
}
36+
37+
protected static String sanitizeName(String name) {
38+
// sanitize names contained in .class files
39+
return name
40+
.replace(':', '_')
41+
.replace(';', '_')
42+
.replace('&', '_')
43+
.replace('%', '_')
44+
.replace('<', '_')
45+
.replace('>', '_');
3546
}
3647

3748
public String getDisplayName() {
@@ -72,5 +83,5 @@ public SELF getPreviousResult() {
7283
public Run<?,?> getBuild() {
7384
return parent.getBuild();
7485
}
75-
86+
7687
}

‎src/main/java/hudson/plugins/jacoco/report/ClassReport.java

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,10 @@ public final class ClassReport extends AggregatedReport<PackageReport,ClassRepor
1515

1616
@Override
1717
public void setName(String name) {
18-
super.setName(name.replaceAll("/", "."));
18+
super.setName(name.replace('/', '.'));
1919
//logger.log(Level.INFO, "ClassReport");
2020
}
21+
2122
@Override
2223
public void add(MethodReport child) {
2324
String newChildName = child.getName();

‎src/main/java/hudson/plugins/jacoco/report/MethodReport.java

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@
1313
*/
1414
//AggregatedReport<PackageReport,ClassReport,MethodReport> - AbstractReport<ClassReport,MethodReport>
1515
public final class MethodReport extends AggregatedReport<ClassReport,MethodReport, SourceFileReport> {
16-
16+
1717
private IMethodCoverage methodCov;
18-
18+
1919
@Override
2020
public String printFourCoverageColumns() {
2121
StringBuilder buf = new StringBuilder();
@@ -32,10 +32,10 @@ public String printFourCoverageColumns() {
3232
//logger.log(Level.INFO, "Printing Ratio cells within MethodReport.");
3333
return buf.toString();
3434
}
35-
35+
3636
@Override
3737
public void add(SourceFileReport child) {
38-
String newChildName = child.getName().replaceAll(this.getName() + ".", "");
38+
String newChildName = child.getName().replace(this.getName() + ".", "");
3939
child.setName(newChildName);
4040
getChildren().put(child.getName(), child);
4141
//logger.log(Level.INFO, "SourceFileReport");
@@ -45,11 +45,11 @@ public void add(SourceFileReport child) {
4545
public boolean hasClassCoverage() {
4646
return false;
4747
}
48-
48+
4949
public void setSrcFileInfo(IMethodCoverage methodCov) {
5050
this.methodCov = methodCov;
5151
}
52-
52+
5353
public void printHighlightedSrcFile(Writer output) {
5454
new SourceAnnotator(getParent().getSourceFilePath()).printHighlightedSrcFile(methodCov,output);
5555
}

‎src/main/java/hudson/plugins/jacoco/report/PackageReport.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,17 @@ public String getName() {
1818

1919
@Override
2020
public void setName(String name) {
21-
super.setName(name.replaceAll("/", "."));
21+
super.setName(name.replace('/', '.'));
2222
}
23-
23+
2424
@Override
2525
public void add(ClassReport child) {
26-
String newChildName = child.getName().replaceAll(this.getName() + ".", "");
26+
String newChildName = child.getName().replace(this.getName() + ".", "");
2727
child.setName(newChildName);
2828
this.getChildren().put(child.getName(), child);
2929
//logger.log(Level.INFO, "PackageReport");
3030
}
31-
31+
3232
//private static final Logger logger = Logger.getLogger(CoverageObject.class.getName());
33-
33+
3434
}

‎src/main/java/hudson/plugins/jacoco/report/SourceFileReport.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,12 @@
55
* @author Kohsuke Kawaguchi
66
*/
77
public final class SourceFileReport extends AbstractReport<MethodReport,SourceFileReport> {
8-
8+
99
@Override
1010
public void setName(String name) {
11-
super.setName(name.replaceAll("/", "."));
11+
super.setName(name.replace('/', '.'));
1212
//logger.log(Level.INFO, "SourceFileReport");
1313
}
14-
14+
1515
//private static final Logger logger = Logger.getLogger(SourceFileReport.class.getName());
16-
}
16+
}

‎src/test/java/hudson/plugins/jacoco/report/AbstractReportTest.java

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ public void test() throws Exception {
1717
// abstract class but not abstract method to override
1818
};
1919
assertNotNull(report);
20-
20+
2121
report.setParent(new ClassReport());
2222
report.getParent().setParent(new PackageReport());
2323

@@ -33,7 +33,11 @@ public void test() throws Exception {
3333
report.setName("testname");
3434
assertEquals("testname", report.getName());
3535
assertEquals("testname", report.getDisplayName());
36-
36+
37+
report.setName("myname/&:<>2%;");
38+
assertEquals("myname/____2__", report.getName());
39+
assertEquals("myname/____2__", report.getDisplayName());
40+
3741
// TODO: cause NPEs, did not find out how to test this without a full jenkins-test
3842
//assertNull(report.getPreviousResult());
3943
//CoverageElement cv = new CoverageElement();

‎src/test/java/hudson/plugins/jacoco/report/AggregatedReportTest.java

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,36 +11,40 @@ public class AggregatedReportTest {
1111
public void testSetFailed() throws Exception {
1212
AggregatedReport<PackageReport,ClassReport,MethodReport> report = new AggregatedReport<PackageReport,ClassReport,MethodReport>() {
1313
};
14-
14+
1515
assertEquals(0, report.getChildren().size());
1616
assertFalse(report.hasChildren());
17-
17+
1818
MethodReport child = new MethodReport();
1919
child.setName("testmethod");
2020
report.add(child);
2121
assertEquals(1, report.getChildren().size());
2222
assertTrue(report.hasChildren());
2323
assertFalse(report.hasChildrenClassCoverage());
2424
assertFalse(report.hasChildrenLineCoverage());
25-
25+
2626
report.setParent(new PackageReport());
2727
assertNotNull(report.getParent());
28-
28+
2929
assertNull(report.getDynamic("test", null, null));
3030
assertNotNull(report.getDynamic("testmethod", null, null));
31-
31+
3232
report.setFailed();
33-
33+
3434
child.getLineCoverage().accumulate(0, 3);
3535
assertTrue(report.hasChildrenLineCoverage());
3636

3737
child.getClassCoverage().accumulate(0, 3);
3838
assertFalse("For method children it's always false", report.hasChildrenClassCoverage());
39+
40+
report.setName("myname/&:<>2%;");
41+
assertEquals("myname/____2__", report.getName());
42+
assertEquals("myname/____2__", report.getDisplayName());
3943
}
40-
44+
4145
@Test
4246
public void testClassCoverage() {
43-
AggregatedReport<CoverageReport,PackageReport,ClassReport> packageReport =
47+
AggregatedReport<CoverageReport,PackageReport,ClassReport> packageReport =
4448
new AggregatedReport<CoverageReport, PackageReport, ClassReport>() {
4549
};
4650

@@ -52,8 +56,13 @@ public void testClassCoverage() {
5256
assertFalse(packageReport.hasChildrenLineCoverage());
5357

5458
classChild.getClassCoverage().accumulate(0, 3);
55-
59+
5660
assertTrue(packageReport.hasChildrenClassCoverage());
5761
assertFalse(packageReport.hasChildrenLineCoverage());
62+
63+
classChild = new ClassReport();
64+
classChild.setName("testclass/pkg");
65+
packageReport.add(classChild);
66+
assertEquals("testclass.pkg", classChild.getName());
5867
}
5968
}

‎src/test/java/hudson/plugins/jacoco/report/ClassReportTest.java

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -11,46 +11,50 @@
1111
public class ClassReportTest {
1212

1313
@Test
14-
public void testName() throws Exception {
14+
public void testName() {
1515
ClassReport report = new ClassReport();
1616
report.setName("testname");
1717
assertEquals("testname", report.getName());
1818
report.setName("test/name/1");
1919
assertEquals("test.name.1", report.getName());
20+
21+
report.setName("myname/&:<>2%;");
22+
assertEquals("myname.____2__", report.getName());
23+
assertEquals("myname.____2__", report.getDisplayName());
2024
}
21-
25+
2226
@Test
23-
public void testChildren() throws Exception {
27+
public void testChildren() {
2428
ClassReport report = new ClassReport();
25-
29+
2630
assertEquals(0, report.getChildren().size());
2731
MethodReport child = new MethodReport();
2832
child.setName("testname");
2933
report.add(child);
3034
assertEquals(1, report.getChildren().size());
3135
}
32-
36+
3337
@Test
34-
public void testSourceFile() throws Exception {
38+
public void testSourceFile() {
3539
ClassReport report = new ClassReport();
3640
report.setSrcFileInfo(null, "some/path");
3741
assertEquals(new File("some/path"), report.getSourceFilePath());
3842
}
39-
43+
4044
@Test
41-
public void testPrint() throws Exception {
45+
public void testPrint() {
4246
ClassReport report = new ClassReport();
4347
report.setSrcFileInfo(null, "some/path");
44-
48+
4549
StringWriter writer = new StringWriter();
4650
report.printHighlightedSrcFile(writer);
47-
51+
4852
String string = writer.toString();
4953
assertEquals("ERROR: Error while reading the sourcefile!", string);
5054
}
51-
55+
5256
@Test
53-
public void testToString() throws Exception {
57+
public void testToString() {
5458
ClassReport report = new ClassReport();
5559
assertNotNull(report.toString());
5660
}

‎src/test/java/hudson/plugins/jacoco/report/CoverageReportTest.java

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,27 +11,31 @@
1111

1212
public class CoverageReportTest {
1313
@Test
14-
public void testGetBuild() throws Exception {
14+
public void testGetBuild() {
1515
CoverageReport report = new CoverageReport(action, new ExecutionFileLoader());
1616
assertNull(report.getBuild());
1717
}
1818

1919
@Test
20-
public void testName() throws Exception {
20+
public void testName() {
2121
CoverageReport report = new CoverageReport(action, new ExecutionFileLoader());
2222
assertEquals("Jacoco", report.getName());
23+
24+
report.setName("myname/&:<>2%;");
25+
assertEquals("myname/____2__", report.getName());
26+
assertEquals("myname/____2__", report.getDisplayName());
2327
}
2428

2529
@Test
26-
public void testDoJaCoCoExec() throws Exception {
30+
public void testDoJaCoCoExec() {
2731
CoverageReport report = new CoverageReport(action, new ExecutionFileLoader());
2832
assertNotNull(report);
2933
// TODO: how to simulate JaCoCoBuildAction without full Jenkins test-framework?
3034
// report.doJacocoExec();
3135
}
3236

3337
@Test
34-
public void testThresholds() throws Exception {
38+
public void testThresholds() {
3539
CoverageReport report = new CoverageReport(action, new ExecutionFileLoader());
3640
report.setThresholds(new JacocoHealthReportThresholds());
3741
}

‎src/test/java/hudson/plugins/jacoco/report/MethodReportTest.java

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -12,47 +12,53 @@ public class MethodReportTest {
1212
public void testMissingFile() {
1313
MethodReport report = new MethodReport();
1414
assertFalse(report.hasClassCoverage());
15-
15+
1616
report.setSrcFileInfo(null);
17-
17+
1818
ClassReport p = new ClassReport();
1919
p.setSrcFileInfo(null, "some/path");
2020
report.setParent(p);
21-
21+
2222
StringWriter writer = new StringWriter();
2323
report.printHighlightedSrcFile(writer);
2424
String string = writer.toString();
2525
assertEquals("ERROR: Error while reading the sourcefile!", string);
26+
27+
report.setName("myname/&:<>2%;");
28+
assertEquals("myname/____2__", report.getName());
29+
assertEquals("myname/____2__", report.getDisplayName());
2630
}
2731

2832
@Test
29-
public void testPrint() throws Exception {
33+
public void testPrint() {
3034
MethodReport report = new MethodReport();
3135
assertNotNull(report.printFourCoverageColumns());
3236
}
3337

3438
@Test
35-
public void testChildren() throws Exception {
39+
public void testChildren() {
3640
MethodReport report = new MethodReport();
3741
report.setName("pkg");
38-
42+
3943
assertEquals(0, report.getChildren().size());
4044
SourceFileReport child = new SourceFileReport();
4145
child.setName("testname");
4246
report.add(child);
47+
assertEquals("testname", child.getName());
4348
assertEquals(1, report.getChildren().size());
4449
assertEquals("testname", report.getChildren().values().iterator().next().getName());
4550
}
4651

4752
@Test
48-
public void testChildrenRemovePkgName() throws Exception {
53+
public void testChildrenRemovePkgName() {
4954
MethodReport report = new MethodReport();
5055
report.setName("pkg");
51-
56+
5257
assertEquals(0, report.getChildren().size());
5358
SourceFileReport child = new SourceFileReport();
5459
child.setName("pkg.testname");
5560
report.add(child);
61+
assertEquals("testname", child.getName());
5662
assertEquals(1, report.getChildren().size());
5763
assertEquals("testname", report.getChildren().values().iterator().next().getName());
5864
}

0 commit comments

Comments
 (0)