{"action":"created","comment":{"url":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/comments/63010640","id":63010640,"diff_hunk":"@@ -0,0 +1,27 @@\n+---\n+:layout: post\n+:title: Security updates for Jenkins core\n+:tags:\n+- core\n+- security\n+:author: daniel-beck\n+---\n+We just released security updates to Jenkins that fix a number of low and medium severity issues. For an overview of what was fixed, see the [security advisory](https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2016-05-11).\n+\n+One of the fixes may well break some of your use cases in Jenkins, at least until plugins have been adapted: SECURITY-170. This change removes parameters that are not defined on a job from the build environment. So, right now, a job could even be unparameterized, and plugins were able to pass parameters anyway. Since build parameters are added to the environment variables of scripts run during a build, parameters such as `PATH` or `DYLD_LIBRARY_PATH` can be defined -- on jobs which don't even expect those as build parameters -- to change the behavior of builds.\n+\n+A number of plugins define additional parameters for builds. For example, GitHub Pull Request Builder passes a number of additional parameters describing the pull request. Release Plugin also allows adding several additional parameters to a build that are not considered to be defined in the job as part of this security fix.\n+\n+Until these plugins have been adapted to work with the new restriction (and advice on that is available further down), you can define the following system properties to work around this limitation, at least for a time:\n+\n+* Set `hudson.model.ParametersAction.keepUndefinedParameters` to `true`, e.g. `java -Dhudson.model.ParametersAction.keepUndefinedParameters=true -jar jenkins.war` to revert to the old behavior of allowing any build parameters. Depending on your environment, this may be unsafe, as it opens you up to attacks as described above.\n+* Set `hudson.model.ParametersAction.safeParameters` to a comma-separated list of safe parameter names, e.g. `java -Dhudson.model.ParametersAction.safeParameters=FOO,BAR_baz,quX -jar jenkins.war`.\n+\n+I realize this change, among a few others that improve the security of Jenkins, may be difficult to adapt for some, but given the valuable secrets typically stored in Jenkins, I'm certain that this is the correct approach. We made sure to release this fix with the options described above, so that this change doesn't block updating those that rely on this behavior.\n+\n+Developers have several options to adapt to this change:\n+\n+* `ParametersAction` actually stores all parameters, but `getParameters()` only returns those that are defined on the job. The new method `getAllParameters()` returns all of them. This can be used, for example by `EnvironmentContributor` extensions, to add known safe parameters to build environments.\n+* Don't pass extra arguments, but define a `QueueAction` for your metadata instead. Those can still be made available to the build environment as needed.","path":"content/blog/2016/2016-05-11-security-update.md","position":25,"original_position":25,"commit_id":"9fe897b613b9934971f44b3e00ebc62838681b58","original_commit_id":"9fe897b613b9934971f44b3e00ebc62838681b58","user":{"login":"orrc","id":138615,"avatar_url":"https://avatars.githubusercontent.com/u/138615?v=3","gravatar_id":"","url":"https://api.github.com/users/orrc","html_url":"https://github.com/orrc","followers_url":"https://api.github.com/users/orrc/followers","following_url":"https://api.github.com/users/orrc/following{/other_user}","gists_url":"https://api.github.com/users/orrc/gists{/gist_id}","starred_url":"https://api.github.com/users/orrc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/orrc/subscriptions","organizations_url":"https://api.github.com/users/orrc/orgs","repos_url":"https://api.github.com/users/orrc/repos","events_url":"https://api.github.com/users/orrc/events{/privacy}","received_events_url":"https://api.github.com/users/orrc/received_events","type":"User","site_admin":false},"body":"`pass extra arguments` -> `define extra parameters`?","created_at":"2016-05-12T12:25:45Z","updated_at":"2016-05-12T12:25:45Z","html_url":"https://github.com/jenkins-infra/jenkins.io/pull/249#discussion_r63010640","pull_request_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/249","_links":{"self":{"href":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/comments/63010640"},"html":{"href":"https://github.com/jenkins-infra/jenkins.io/pull/249#discussion_r63010640"},"pull_request":{"href":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/249"}}},"pull_request":{"url":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/249","id":69726765,"html_url":"https://github.com/jenkins-infra/jenkins.io/pull/249","diff_url":"https://github.com/jenkins-infra/jenkins.io/pull/249.diff","patch_url":"https://github.com/jenkins-infra/jenkins.io/pull/249.patch","issue_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/issues/249","number":249,"state":"closed","locked":false,"title":"Add blog post for 2016-05-11 security update","user":{"login":"daniel-beck","id":1831569,"avatar_url":"https://avatars.githubusercontent.com/u/1831569?v=3","gravatar_id":"","url":"https://api.github.com/users/daniel-beck","html_url":"https://github.com/daniel-beck","followers_url":"https://api.github.com/users/daniel-beck/followers","following_url":"https://api.github.com/users/daniel-beck/following{/other_user}","gists_url":"https://api.github.com/users/daniel-beck/gists{/gist_id}","starred_url":"https://api.github.com/users/daniel-beck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daniel-beck/subscriptions","organizations_url":"https://api.github.com/users/daniel-beck/orgs","repos_url":"https://api.github.com/users/daniel-beck/repos","events_url":"https://api.github.com/users/daniel-beck/events{/privacy}","received_events_url":"https://api.github.com/users/daniel-beck/received_events","type":"User","site_admin":false},"body":"","created_at":"2016-05-11T19:18:02Z","updated_at":"2016-05-12T12:25:45Z","closed_at":"2016-05-11T20:41:58Z","merged_at":"2016-05-11T20:41:58Z","merge_commit_sha":"6e192a592ef39691d30f1bfeaa5a0ef0a4e7abc8","assignee":{"login":"rtyler","id":26594,"avatar_url":"https://avatars.githubusercontent.com/u/26594?v=3","gravatar_id":"","url":"https://api.github.com/users/rtyler","html_url":"https://github.com/rtyler","followers_url":"https://api.github.com/users/rtyler/followers","following_url":"https://api.github.com/users/rtyler/following{/other_user}","gists_url":"https://api.github.com/users/rtyler/gists{/gist_id}","starred_url":"https://api.github.com/users/rtyler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rtyler/subscriptions","organizations_url":"https://api.github.com/users/rtyler/orgs","repos_url":"https://api.github.com/users/rtyler/repos","events_url":"https://api.github.com/users/rtyler/events{/privacy}","received_events_url":"https://api.github.com/users/rtyler/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/249/commits","review_comments_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/249/comments","review_comment_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/comments{/number}","comments_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/issues/249/comments","statuses_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/statuses/9fe897b613b9934971f44b3e00ebc62838681b58","head":{"label":"daniel-beck:2016-05-11-security-update","ref":"2016-05-11-security-update","sha":"9fe897b613b9934971f44b3e00ebc62838681b58","user":{"login":"daniel-beck","id":1831569,"avatar_url":"https://avatars.githubusercontent.com/u/1831569?v=3","gravatar_id":"","url":"https://api.github.com/users/daniel-beck","html_url":"https://github.com/daniel-beck","followers_url":"https://api.github.com/users/daniel-beck/followers","following_url":"https://api.github.com/users/daniel-beck/following{/other_user}","gists_url":"https://api.github.com/users/daniel-beck/gists{/gist_id}","starred_url":"https://api.github.com/users/daniel-beck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daniel-beck/subscriptions","organizations_url":"https://api.github.com/users/daniel-beck/orgs","repos_url":"https://api.github.com/users/daniel-beck/repos","events_url":"https://api.github.com/users/daniel-beck/events{/privacy}","received_events_url":"https://api.github.com/users/daniel-beck/received_events","type":"User","site_admin":false},"repo":{"id":44983695,"name":"jenkins.io","full_name":"daniel-beck/jenkins.io","owner":{"login":"daniel-beck","id":1831569,"avatar_url":"https://avatars.githubusercontent.com/u/1831569?v=3","gravatar_id":"","url":"https://api.github.com/users/daniel-beck","html_url":"https://github.com/daniel-beck","followers_url":"https://api.github.com/users/daniel-beck/followers","following_url":"https://api.github.com/users/daniel-beck/following{/other_user}","gists_url":"https://api.github.com/users/daniel-beck/gists{/gist_id}","starred_url":"https://api.github.com/users/daniel-beck/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/daniel-beck/subscriptions","organizations_url":"https://api.github.com/users/daniel-beck/orgs","repos_url":"https://api.github.com/users/daniel-beck/repos","events_url":"https://api.github.com/users/daniel-beck/events{/privacy}","received_events_url":"https://api.github.com/users/daniel-beck/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/daniel-beck/jenkins.io","description":"A static site for the Jenkins automation server","fork":true,"url":"https://api.github.com/repos/daniel-beck/jenkins.io","forks_url":"https://api.github.com/repos/daniel-beck/jenkins.io/forks","keys_url":"https://api.github.com/repos/daniel-beck/jenkins.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/daniel-beck/jenkins.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/daniel-beck/jenkins.io/teams","hooks_url":"https://api.github.com/repos/daniel-beck/jenkins.io/hooks","issue_events_url":"https://api.github.com/repos/daniel-beck/jenkins.io/issues/events{/number}","events_url":"https://api.github.com/repos/daniel-beck/jenkins.io/events","assignees_url":"https://api.github.com/repos/daniel-beck/jenkins.io/assignees{/user}","branches_url":"https://api.github.com/repos/daniel-beck/jenkins.io/branches{/branch}","tags_url":"https://api.github.com/repos/daniel-beck/jenkins.io/tags","blobs_url":"https://api.github.com/repos/daniel-beck/jenkins.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/daniel-beck/jenkins.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/daniel-beck/jenkins.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/daniel-beck/jenkins.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/daniel-beck/jenkins.io/statuses/{sha}","languages_url":"https://api.github.com/repos/daniel-beck/jenkins.io/languages","stargazers_url":"https://api.github.com/repos/daniel-beck/jenkins.io/stargazers","contributors_url":"https://api.github.com/repos/daniel-beck/jenkins.io/contributors","subscribers_url":"https://api.github.com/repos/daniel-beck/jenkins.io/subscribers","subscription_url":"https://api.github.com/repos/daniel-beck/jenkins.io/subscription","commits_url":"https://api.github.com/repos/daniel-beck/jenkins.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/daniel-beck/jenkins.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/daniel-beck/jenkins.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/daniel-beck/jenkins.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/daniel-beck/jenkins.io/contents/{+path}","compare_url":"https://api.github.com/repos/daniel-beck/jenkins.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/daniel-beck/jenkins.io/merges","archive_url":"https://api.github.com/repos/daniel-beck/jenkins.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/daniel-beck/jenkins.io/downloads","issues_url":"https://api.github.com/repos/daniel-beck/jenkins.io/issues{/number}","pulls_url":"https://api.github.com/repos/daniel-beck/jenkins.io/pulls{/number}","milestones_url":"https://api.github.com/repos/daniel-beck/jenkins.io/milestones{/number}","notifications_url":"https://api.github.com/repos/daniel-beck/jenkins.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/daniel-beck/jenkins.io/labels{/name}","releases_url":"https://api.github.com/repos/daniel-beck/jenkins.io/releases{/id}","deployments_url":"https://api.github.com/repos/daniel-beck/jenkins.io/deployments","created_at":"2015-10-26T16:58:31Z","updated_at":"2016-01-07T18:10:46Z","pushed_at":"2016-05-11T20:39:52Z","git_url":"git://github.com/daniel-beck/jenkins.io.git","ssh_url":"git@github.com:daniel-beck/jenkins.io.git","clone_url":"https://github.com/daniel-beck/jenkins.io.git","svn_url":"https://github.com/daniel-beck/jenkins.io","homepage":"http://jenkins.lasagna.io","size":35442,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"jenkins-infra:master","ref":"master","sha":"f92a0169a22cf131d691a5e4294ed7fc807edda6","user":{"login":"jenkins-infra","id":7422698,"avatar_url":"https://avatars.githubusercontent.com/u/7422698?v=3","gravatar_id":"","url":"https://api.github.com/users/jenkins-infra","html_url":"https://github.com/jenkins-infra","followers_url":"https://api.github.com/users/jenkins-infra/followers","following_url":"https://api.github.com/users/jenkins-infra/following{/other_user}","gists_url":"https://api.github.com/users/jenkins-infra/gists{/gist_id}","starred_url":"https://api.github.com/users/jenkins-infra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jenkins-infra/subscriptions","organizations_url":"https://api.github.com/users/jenkins-infra/orgs","repos_url":"https://api.github.com/users/jenkins-infra/repos","events_url":"https://api.github.com/users/jenkins-infra/events{/privacy}","received_events_url":"https://api.github.com/users/jenkins-infra/received_events","type":"Organization","site_admin":false},"repo":{"id":44886691,"name":"jenkins.io","full_name":"jenkins-infra/jenkins.io","owner":{"login":"jenkins-infra","id":7422698,"avatar_url":"https://avatars.githubusercontent.com/u/7422698?v=3","gravatar_id":"","url":"https://api.github.com/users/jenkins-infra","html_url":"https://github.com/jenkins-infra","followers_url":"https://api.github.com/users/jenkins-infra/followers","following_url":"https://api.github.com/users/jenkins-infra/following{/other_user}","gists_url":"https://api.github.com/users/jenkins-infra/gists{/gist_id}","starred_url":"https://api.github.com/users/jenkins-infra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jenkins-infra/subscriptions","organizations_url":"https://api.github.com/users/jenkins-infra/orgs","repos_url":"https://api.github.com/users/jenkins-infra/repos","events_url":"https://api.github.com/users/jenkins-infra/events{/privacy}","received_events_url":"https://api.github.com/users/jenkins-infra/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/jenkins-infra/jenkins.io","description":"A static site for the Jenkins automation server","fork":false,"url":"https://api.github.com/repos/jenkins-infra/jenkins.io","forks_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/forks","keys_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/teams","hooks_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/hooks","issue_events_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/issues/events{/number}","events_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/events","assignees_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/assignees{/user}","branches_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/branches{/branch}","tags_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/tags","blobs_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/statuses/{sha}","languages_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/languages","stargazers_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/stargazers","contributors_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/contributors","subscribers_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/subscribers","subscription_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/subscription","commits_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/contents/{+path}","compare_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/merges","archive_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/downloads","issues_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/issues{/number}","pulls_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls{/number}","milestones_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/milestones{/number}","notifications_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/labels{/name}","releases_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/releases{/id}","deployments_url":"https://api.github.com/repos/jenkins-infra/jenkins.io/deployments","created_at":"2015-10-24T22:02:57Z","updated_at":"2016-05-09T05:20:21Z","pushed_at":"2016-05-12T12:22:54Z","git_url":"git://github.com/jenkins-infra/jenkins.io.git","ssh_url":"git@github.com:jenkins-infra/jenkins.io.git","clone_url":"https://github.com/jenkins-infra/jenkins.io.git","svn_url":"https://github.com/jenkins-infra/jenkins.io","homepage":"https://jenkins.io","size":44632,"stargazers_count":20,"watchers_count":20,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":66,"mirror_url":null,"open_issues_count":9,"forks":66,"open_issues":9,"watchers":20,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/249"},"html":{"href":"https://github.com/jenkins-infra/jenkins.io/pull/249"},"issue":{"href":"https://api.github.com/repos/jenkins-infra/jenkins.io/issues/249"},"comments":{"href":"https://api.github.com/repos/jenkins-infra/jenkins.io/issues/249/comments"},"review_comments":{"href":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/249/comments"},"review_comment":{"href":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/jenkins-infra/jenkins.io/pulls/249/commits"},"statuses":{"href":"https://api.github.com/repos/jenkins-infra/jenkins.io/statuses/9fe897b613b9934971f44b3e00ebc62838681b58"}}}}