[SECURITY-3235]

jenkinsci · Aug 24, 2023 · 3039470 · 3039470
1 parent f5d8780
commit 3039470
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 3 deletions.
diff --git a/src/main/java/hudson/plugins/jobConfigHistory/FileHistoryDao.java b/src/main/java/hudson/plugins/jobConfigHistory/FileHistoryDao.java
@@ -618,7 +618,13 @@ private int countSubDirs(File[] files) {
     public XmlFile getOldRevision(final AbstractItem item,
                                   final String identifier) {
         final File configFile = item.getConfigFile().getFile();
-        final File historyDir = new File(getHistoryDir(configFile), identifier);
+        final File historyDirFromConfigFile = getHistoryDir(configFile);
+        final File historyDir = new File(historyDirFromConfigFile, identifier);
+
+        if(!fileIsContainedInDirectory(historyDir, historyDirFromConfigFile)) {
+            return new XmlFile(null);
+        }
+
         if (PluginUtils.isMavenPluginAvailable()
                 && item instanceof MavenModule) {
             final String path = historyDir
@@ -1338,8 +1344,14 @@ public void saveNode(final Node node) {
 
     @Override
     public XmlFile getOldRevision(final Node node, final String identifier) {
-        final File historyDir = new File(getHistoryDirForNode(node),
+        final File historyDirForNode = getHistoryDirForNode(node);
+        final File historyDir = new File(historyDirForNode,
                 identifier);
+
+        if(!fileIsContainedInDirectory(historyDir, historyDirForNode)) {
+            return new XmlFile(null);
+        }
+
         return new XmlFile(getConfigFile(historyDir));
     }
 

diff --git a/src/main/java/hudson/plugins/jobConfigHistory/JobConfigHistoryBaseAction.java b/src/main/java/hudson/plugins/jobConfigHistory/JobConfigHistoryBaseAction.java
@@ -51,6 +51,7 @@
 import org.xmlunit.diff.ElementSelectors;
 
 import javax.servlet.ServletException;
+import javax.xml.XMLConstants;
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerException;
 import javax.xml.transform.TransformerFactory;
@@ -89,7 +90,13 @@
 public abstract class JobConfigHistoryBaseAction implements Action {
 
     private static final Logger LOG = Logger.getLogger(JobConfigHistoryBaseAction.class.getName());
-    private final TransformerFactory transformerFactory = TransformerFactory.newInstance();
+    private final TransformerFactory transformerFactory;
+
+    public JobConfigHistoryBaseAction() {
+        transformerFactory = TransformerFactory.newInstance();
+        transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        transformerFactory.setAttribute(XMLConstants.ACCESS_EXTERNAL_STYLESHEET, "");
+    }
 
     @Override
     public String getDisplayName() {