Skip to content

Commit 365d03e

Browse files
krissternkrisstern
authored
[JENKINS-75174] Move existing web.xml to web-fragment.xml under core (#10185)
2 parents 5aca30a + d3beede commit 365d03e

File tree

2 files changed

+280
-250
lines changed

2 files changed

+280
-250
lines changed

‎core/src/main/resources/META-INF/web-fragment.xml‎

Lines changed: 279 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,279 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
The MIT License
4+
5+
Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Tom Huybrechts, id:digerata, Yahoo! Inc.
6+
7+
Permission is hereby granted, free of charge, to any person obtaining a copy
8+
of this software and associated documentation files (the "Software"), to deal
9+
in the Software without restriction, including without limitation the rights
10+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11+
copies of the Software, and to permit persons to whom the Software is
12+
furnished to do so, subject to the following conditions:
13+
14+
The above copyright notice and this permission notice shall be included in
15+
all copies or substantial portions of the Software.
16+
17+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23+
THE SOFTWARE.
24+
-->
25+
26+
<web-fragment xmlns="http://xmlns.jcp.org/xml/ns/javaee"
27+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
28+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-fragment_3_1.xsd"
29+
version="3.1">
30+
<name>jenkins</name>
31+
32+
<servlet>
33+
<servlet-name>Stapler</servlet-name>
34+
<servlet-class>org.kohsuke.stapler.Stapler</servlet-class>
35+
<init-param>
36+
<param-name>default-encodings</param-name>
37+
<param-value>text/html=UTF-8</param-value>
38+
</init-param>
39+
<init-param>
40+
<param-name>diagnosticThreadName</param-name>
41+
<param-value>false</param-value>
42+
</init-param>
43+
<async-supported>true</async-supported>
44+
</servlet>
45+
46+
<servlet-mapping>
47+
<servlet-name>Stapler</servlet-name>
48+
<url-pattern>/*</url-pattern>
49+
</servlet-mapping>
50+
51+
<filter>
52+
<filter-name>suspicious-request-filter</filter-name>
53+
<filter-class>jenkins.security.SuspiciousRequestFilter</filter-class>
54+
<async-supported>true</async-supported>
55+
</filter>
56+
<filter>
57+
<filter-name>diagnostic-name-filter</filter-name>
58+
<filter-class>org.kohsuke.stapler.DiagnosticThreadNameFilter</filter-class>
59+
<async-supported>true</async-supported>
60+
</filter>
61+
<filter>
62+
<filter-name>encoding-filter</filter-name>
63+
<filter-class>hudson.util.CharacterEncodingFilter</filter-class>
64+
<async-supported>true</async-supported>
65+
</filter>
66+
<filter>
67+
<filter-name>uncaught-exception-filter</filter-name>
68+
<filter-class>org.kohsuke.stapler.UncaughtExceptionFilter</filter-class>
69+
<async-supported>true</async-supported>
70+
</filter>
71+
<filter>
72+
<filter-name>authentication-filter</filter-name>
73+
<filter-class>hudson.security.HudsonFilter</filter-class>
74+
<async-supported>true</async-supported>
75+
</filter>
76+
<filter>
77+
<filter-name>csrf-filter</filter-name>
78+
<filter-class>hudson.security.csrf.CrumbFilter</filter-class>
79+
<async-supported>true</async-supported>
80+
</filter>
81+
<filter>
82+
<filter-name>error-attribute-filter</filter-name>
83+
<filter-class>jenkins.ErrorAttributeFilter</filter-class>
84+
<async-supported>true</async-supported>
85+
</filter>
86+
<filter>
87+
<filter-name>plugins-filter</filter-name>
88+
<filter-class>hudson.util.PluginServletFilter</filter-class>
89+
<async-supported>true</async-supported>
90+
</filter>
91+
92+
<!--
93+
The Headers filter allows us to override headers sent by the container
94+
that may be in conflict with what we want. For example, Tomcat will set
95+
Cache-Control: no-cache for any files behind the security-constraint
96+
below. So if Hudson is on a public server, and you want to only allow
97+
authorized users to access it, you may want to pay attention to this.
98+
99+
See: http://www.nabble.com/No-browser-caching-with-Hudson- -tf4601857.html
100+
101+
<filter>
102+
<filter-name>change-headers-filter</filter-name>
103+
<filter-class>hudson.ResponseHeaderFilter</filter-class>
104+
<!- The value listed here is for 24 hours. Increase or decrease as you see
105+
fit. Value is in seconds. Make sure to keep the public option ->
106+
<init-param>
107+
<param-name>Cache-Control</param-name>
108+
<param-value>max-age=86400, public</param-value>
109+
</init-param>
110+
<!- It turns out that Tomcat just doesn't want to let
111+
go of its cache option. If you override Cache-Control,
112+
it starts to send Pragma: no-cache as a backup.
113+
->
114+
<init-param>
115+
<param-name>Pragma</param-name>
116+
<param-value>public</param-value>
117+
</init-param>
118+
</filter>
119+
<filter-mapping>
120+
<filter-name>change-headers-filter</filter-name>
121+
<url-pattern>*.css</url-pattern>
122+
</filter-mapping>
123+
<filter-mapping>
124+
<filter-name>change-headers-filter</filter-name>
125+
<url-pattern>*.gif</url-pattern>
126+
</filter-mapping>
127+
<filter-mapping>
128+
<filter-name>change-headers-filter</filter-name>
129+
<url-pattern>*.js</url-pattern>
130+
</filter-mapping>
131+
<filter-mapping>
132+
<filter-name>change-headers-filter</filter-name>
133+
<url-pattern>*.png</url-pattern>
134+
</filter-mapping>
135+
-->
136+
137+
<filter-mapping>
138+
<filter-name>suspicious-request-filter</filter-name>
139+
<url-pattern>/*</url-pattern>
140+
</filter-mapping>
141+
<filter-mapping>
142+
<filter-name>diagnostic-name-filter</filter-name>
143+
<url-pattern>/*</url-pattern>
144+
</filter-mapping>
145+
<filter-mapping>
146+
<filter-name>encoding-filter</filter-name>
147+
<url-pattern>/*</url-pattern>
148+
</filter-mapping>
149+
<filter-mapping>
150+
<filter-name>uncaught-exception-filter</filter-name>
151+
<url-pattern>/*</url-pattern>
152+
</filter-mapping>
153+
<filter-mapping>
154+
<filter-name>authentication-filter</filter-name>
155+
<url-pattern>/*</url-pattern>
156+
</filter-mapping>
157+
<filter-mapping>
158+
<filter-name>csrf-filter</filter-name>
159+
<url-pattern>/*</url-pattern>
160+
</filter-mapping>
161+
<filter-mapping>
162+
<filter-name>error-attribute-filter</filter-name>
163+
<url-pattern>/*</url-pattern>
164+
</filter-mapping>
165+
<filter-mapping>
166+
<filter-name>plugins-filter</filter-name>
167+
<url-pattern>/*</url-pattern>
168+
</filter-mapping>
169+
170+
<listener>
171+
<!-- Must be before WebAppMain in order to initialize the context before the first use of this class. -->
172+
<listener-class>jenkins.util.SystemProperties$Listener</listener-class>
173+
</listener>
174+
<listener>
175+
<listener-class>hudson.WebAppMain</listener-class>
176+
</listener>
177+
<listener>
178+
<listener-class>jenkins.JenkinsHttpSessionListener</listener-class>
179+
</listener>
180+
181+
<!--
182+
JENKINS-1235 suggests containers interpret '*' as "all roles defined in web.xml"
183+
as opposed to "all roles defined in the security realm", so we need to list some
184+
common names in the hope that users will have at least one of those roles.
185+
-->
186+
<security-role>
187+
<role-name>admin</role-name>
188+
</security-role>
189+
<security-role>
190+
<role-name>user</role-name>
191+
</security-role>
192+
<security-role>
193+
<role-name>hudson</role-name>
194+
</security-role>
195+
196+
<security-constraint>
197+
<web-resource-collection>
198+
<web-resource-name>Hudson</web-resource-name>
199+
<url-pattern>/loginEntry</url-pattern>
200+
<!--http-method>GET</http-method-->
201+
</web-resource-collection>
202+
<auth-constraint>
203+
<role-name>**</role-name>
204+
</auth-constraint>
205+
</security-constraint>
206+
207+
<!-- Disable TRACE method with security constraint (copied from jetty/webdefaults.xml) -->
208+
<security-constraint>
209+
<web-resource-collection>
210+
<web-resource-name>Disable TRACE</web-resource-name>
211+
<url-pattern>/*</url-pattern>
212+
<http-method>TRACE</http-method>
213+
</web-resource-collection>
214+
<auth-constraint />
215+
</security-constraint>
216+
217+
<security-constraint>
218+
<web-resource-collection>
219+
<web-resource-name>other</web-resource-name>
220+
<url-pattern>/*</url-pattern>
221+
</web-resource-collection>
222+
<!-- no security constraint -->
223+
</security-constraint>
224+
225+
<login-config>
226+
<auth-method>FORM</auth-method>
227+
<form-login-config>
228+
<form-login-page>/login</form-login-page>
229+
<form-error-page>/loginError</form-error-page>
230+
</form-login-config>
231+
</login-config>
232+
233+
<!-- configure additional extension-content-type mappings -->
234+
<mime-mapping>
235+
<extension>xml</extension>
236+
<mime-type>application/xml</mime-type>
237+
</mime-mapping>
238+
<!--mime-mapping> commenting out until this works out of the box with JOnAS. See http://www.nabble.com/Error-with-mime-type%2D-%27application-xslt%2Bxml%27-when-deploying-hudson-1.316-in-jonas-td24740489.html
239+
<extension>xsl</extension>
240+
<mime-type>application/xslt+xml</mime-type>
241+
</mime-mapping-->
242+
<mime-mapping>
243+
<extension>log</extension>
244+
<mime-type>text/plain</mime-type>
245+
</mime-mapping>
246+
<mime-mapping>
247+
<extension>war</extension>
248+
<mime-type>application/octet-stream</mime-type>
249+
</mime-mapping>
250+
<mime-mapping>
251+
<extension>ear</extension>
252+
<mime-type>application/octet-stream</mime-type>
253+
</mime-mapping>
254+
<mime-mapping>
255+
<extension>rar</extension>
256+
<mime-type>application/octet-stream</mime-type>
257+
</mime-mapping>
258+
<mime-mapping>
259+
<extension>webm</extension>
260+
<mime-type>video/webm</mime-type>
261+
</mime-mapping>
262+
263+
<error-page>
264+
<exception-type>java.lang.Throwable</exception-type>
265+
<location>/oops</location>
266+
</error-page>
267+
<error-page>
268+
<error-code>404</error-code>
269+
<location>/404</location>
270+
</error-page>
271+
272+
<session-config>
273+
<cookie-config>
274+
<!-- See https://www.owasp.org/index.php/HttpOnly for the discussion of this topic in OWASP -->
275+
<http-only>true</http-only>
276+
</cookie-config>
277+
<!-- Tracking mode is managed by WebAppMain.FORCE_SESSION_TRACKING_BY_COOKIE_PROP -->
278+
</session-config>
279+
</web-fragment>

0 commit comments

Comments
 (0)