Skip to content

Commit 70616f9

Browse files
MarkEWaiteMarkEWaite
authored
Merge branch 'master' into progressive-rendering-fix
2 parents 314ca8b + 7d78a7b commit 70616f9

File tree

15 files changed

+145
-34
lines changed

15 files changed

+145
-34
lines changed

‎.github/workflows/announce-lts-rc.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
discourse-author-username: jenkins-release-bot
1818
discourse-category: 23
1919
- name: Post on mailing list
20-
uses: dawidd6/action-send-mail@afe978662944c6805dd197bac88b27acb0bda55a # v8
20+
uses: dawidd6/action-send-mail@62a2d05b79935ad4fb90ce9079928099579c14ac # v9
2121
with:
2222
server_address: smtp.gmail.com
2323
server_port: 465

‎Jenkinsfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ axes.values().combinations {
7171
}
7272
int retryCount = 0
7373
retry(conditions: [kubernetesAgent(handleNonKubernetes: true), nonresumable()], count: 2) {
74-
if (retryCount == 1 && platform == 'windows' ) {
74+
if (retryCount == 1) {
7575
agentContainerLabel = agentContainerLabel + '-nonspot'
7676
}
7777
// Increment before allocating the node in case it fails

‎bom/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ THE SOFTWARE.
4141
<commons-fileupload2.version>2.0.0-M4</commons-fileupload2.version>
4242
<groovy.version>2.4.21</groovy.version>
4343
<jelly.version>1.1-jenkins-20250731</jelly.version>
44-
<stapler.version>2072.ve00de895a_40c</stapler.version>
44+
<stapler.version>2074.v6ff4fa_fccff7</stapler.version>
4545
</properties>
4646

4747
<dependencyManagement>

‎core/src/main/java/hudson/diagnosis/ReverseProxySetupMonitor.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
import java.util.logging.Logger;
3535
import jenkins.model.Jenkins;
3636
import jenkins.security.stapler.StaplerDispatchable;
37+
import jenkins.util.ClientHttpRedirect;
3738
import org.jenkinsci.Symbol;
3839
import org.kohsuke.accmod.Restricted;
3940
import org.kohsuke.accmod.restrictions.DoNotUse;
@@ -127,7 +128,7 @@ public HttpResponse doAct(@QueryParameter String no) throws IOException {
127128
// of course the irony is that this redirect won't work
128129
return HttpResponses.redirectViaContextPath("/manage");
129130
} else {
130-
return new HttpRedirect("https://www.jenkins.io/redirect/troubleshooting/broken-reverse-proxy");
131+
return new ClientHttpRedirect("https://www.jenkins.io/redirect/troubleshooting/broken-reverse-proxy");
131132
}
132133
}
133134

‎core/src/main/java/hudson/security/csrf/DefaultCrumbIssuer.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,15 +24,17 @@
2424
import java.util.logging.Logger;
2525
import jenkins.model.Jenkins;
2626
import jenkins.security.HexStringConfidentialKey;
27+
import jenkins.util.ClientHttpRedirect;
2728
import jenkins.util.SystemProperties;
2829
import net.sf.json.JSONObject;
2930
import org.jenkinsci.Symbol;
3031
import org.kohsuke.accmod.Restricted;
3132
import org.kohsuke.accmod.restrictions.NoExternalUse;
3233
import org.kohsuke.stapler.DataBoundConstructor;
34+
import org.kohsuke.stapler.HttpResponse;
35+
import org.kohsuke.stapler.HttpResponses;
3336
import org.kohsuke.stapler.QueryParameter;
3437
import org.kohsuke.stapler.StaplerRequest2;
35-
import org.kohsuke.stapler.StaplerResponse2;
3638
import org.kohsuke.stapler.verb.POST;
3739
import org.springframework.security.core.Authentication;
3840

@@ -181,15 +183,14 @@ public String getDisplayName() {
181183
}
182184

183185
@POST
184-
public void doAct(StaplerRequest2 req, StaplerResponse2 rsp, @QueryParameter String learn, @QueryParameter String dismiss) throws IOException, ServletException {
186+
public HttpResponse doAct(StaplerRequest2 req, @QueryParameter String learn, @QueryParameter String dismiss) throws IOException, ServletException {
185187
if (learn != null) {
186-
rsp.sendRedirect("https://www.jenkins.io/redirect/csrf-protection/");
187-
return;
188+
return new ClientHttpRedirect("https://www.jenkins.io/redirect/csrf-protection/");
188189
}
189190
if (dismiss != null) {
190191
disable(true);
191192
}
192-
rsp.forwardToPreviousPage(req);
193+
return HttpResponses.forwardToPreviousPage();
193194
}
194195
}
195196

‎core/src/main/java/hudson/util/HttpResponses.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
import java.io.IOException;
3232
import java.nio.charset.StandardCharsets;
3333
import java.util.Map;
34+
import jenkins.util.ClientHttpRedirect;
3435
import net.sf.json.JSONArray;
3536
import net.sf.json.JSONObject;
3637
import org.kohsuke.stapler.HttpResponse;
@@ -51,6 +52,16 @@ public static HttpResponse staticResource(File f) throws IOException {
5152
return staticResource(f.toURI().toURL());
5253
}
5354

55+
/**
56+
* Redirect to the given URL via a client-side JS/meta tag redirect.
57+
* @param url the URL to redirect to
58+
* @return the HttpResponse
59+
* @since TODO
60+
*/
61+
public static HttpResponse clientRedirectTo(String url) {
62+
return new ClientHttpRedirect(url);
63+
}
64+
5465
/**
5566
* Create an empty "ok" response.
5667
*

‎core/src/main/java/jenkins/agents/CloudSet.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -225,9 +225,8 @@ public synchronized void doCreate(StaplerRequest2 req, StaplerResponse2 rsp,
225225

226226
// copy through XStream
227227
String xml = Jenkins.XSTREAM.toXML(src);
228-
// Not great, but cloud name is final
229-
xml = xml.replace("<name>" + src.name + "</name>", "<name>" + name + "</name>");
230228
Cloud result = (Cloud) Jenkins.XSTREAM.fromXML(xml);
229+
result.name = name;
231230
jenkins.clouds.add(result);
232231
// send the browser to the config page
233232
rsp.sendRedirect2(Functions.getNearestAncestorUrl(req, jenkins) + "/" + result.getUrl() + "configure");

‎core/src/main/java/jenkins/monitor/JavaVersionRecommendationAdminMonitor.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,12 +38,12 @@
3838
import java.util.NavigableMap;
3939
import java.util.TreeMap;
4040
import jenkins.model.Jenkins;
41+
import jenkins.util.ClientHttpRedirect;
4142
import jenkins.util.SystemProperties;
4243
import org.jenkinsci.Symbol;
4344
import org.kohsuke.accmod.Restricted;
4445
import org.kohsuke.accmod.restrictions.DoNotUse;
4546
import org.kohsuke.accmod.restrictions.NoExternalUse;
46-
import org.kohsuke.stapler.HttpRedirect;
4747
import org.kohsuke.stapler.HttpResponse;
4848
import org.kohsuke.stapler.HttpResponses;
4949
import org.kohsuke.stapler.QueryParameter;
@@ -138,7 +138,7 @@ public HttpResponse doAct(@QueryParameter String no) throws IOException {
138138
disable(true);
139139
return HttpResponses.forwardToPreviousPage();
140140
} else {
141-
return new HttpRedirect("https://jenkins.io/redirect/java-support/");
141+
return new ClientHttpRedirect("https://jenkins.io/redirect/java-support/");
142142
}
143143
}
144144

‎core/src/main/java/jenkins/security/csp/impl/CspFilter.java‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -63,12 +63,14 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
6363
final String headerName = cspDecorator.getContentSecurityPolicyHeaderName();
6464
final boolean headerShouldBeSet = headerName != null;
6565

66-
// This is the preliminary value outside Stapler request handling (and providing a context object)
67-
final String headerValue = cspDecorator.getContentSecurityPolicyHeaderValue(req);
68-
6966
final boolean isResourceRequest = ResourceDomainConfiguration.isResourceRequest(req);
7067

68+
String headerValue = "";
69+
7170
if (headerShouldBeSet && !isResourceRequest) {
71+
// This is the preliminary value outside Stapler request handling (and providing a context object)
72+
headerValue = cspDecorator.getContentSecurityPolicyHeaderValue(req);
73+
7274
// The Filter/Decorator approach needs us to "set" headers rather than "add", so no additional endpoints are supported at the moment.
7375
final String reportingEndpoints = cspDecorator.getReportingEndpointsHeaderValue(req);
7476
if (reportingEndpoints != null) {
@@ -80,10 +82,10 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
8082
try {
8183
chain.doFilter(req, rsp);
8284
} finally {
83-
if (headerShouldBeSet) {
85+
if (headerShouldBeSet && !isResourceRequest) {
8486
try {
8587
final String actualHeader = rsp.getHeader(headerName);
86-
if (!isResourceRequest && hasUnexpectedDifference(headerValue, actualHeader)) {
88+
if (hasUnexpectedDifference(headerValue, actualHeader)) {
8789
LOGGER.log(Level.FINE, "CSP header has unexpected differences: Expected '" + headerValue + "' but got '" + actualHeader + "'");
8890
}
8991
} catch (RuntimeException e) {

‎core/src/main/java/jenkins/util/ClientHttpRedirect.java‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
/*
2+
* The MIT License
3+
*
4+
* Copyright (c) 2026, CloudBees, Inc.
5+
*
6+
* Permission is hereby granted, free of charge, to any person obtaining a copy
7+
* of this software and associated documentation files (the "Software"), to deal
8+
* in the Software without restriction, including without limitation the rights
9+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
* copies of the Software, and to permit persons to whom the Software is
11+
* furnished to do so, subject to the following conditions:
12+
*
13+
* The above copyright notice and this permission notice shall be included in
14+
* all copies or substantial portions of the Software.
15+
*
16+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22+
* THE SOFTWARE.
23+
*/
24+
25+
package jenkins.util;
26+
27+
import hudson.Util;
28+
import jakarta.servlet.ServletException;
29+
import java.io.IOException;
30+
import org.kohsuke.stapler.HttpResponse;
31+
import org.kohsuke.stapler.StaplerRequest2;
32+
import org.kohsuke.stapler.StaplerResponse2;
33+
34+
/**
35+
* An HTTP response that redirects the client to the given URL.
36+
* Unlike {@link org.kohsuke.stapler.HttpRedirect}, this implements a client-side redirect (using meta tag and/or JavaScript).
37+
* This allows the redirect to work even when Content Security Policy is enforced in Chrome
38+
* (which applies {@code form-action} to redirects after form submission).
39+
* @see <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/form-action">MDN documentation on form-action</a>
40+
* @see <a href="https://github.com/w3c/webappsec-csp/issues/8">Content Security Policy issue discussing this behavior</a>
41+
* @since TODO
42+
*/
43+
public record ClientHttpRedirect(String redirectUrl) implements HttpResponse {
44+
@Override
45+
public void generateResponse(StaplerRequest2 req, StaplerResponse2 rsp, Object o) throws IOException, ServletException {
46+
rsp.setContentType("text/html;charset=UTF-8");
47+
Util.printRedirect(req.getContextPath(), redirectUrl, redirectUrl, rsp.getWriter());
48+
}
49+
}

0 commit comments

Comments
 (0)