Merge branch 'master' into use-jenkins-button-table

.github/dependabot.yml

@@ -58,7 +58,7 @@ updates:
         versions: [">=7.0.0"]
   - package-ecosystem: "maven"
     directory: "/"
-    target-branch: "stable-2.401"
+    target-branch: "stable-2.414"
     labels:
       - "into-lts"
       - "needs-justification"

.github/release-drafter.yml

@@ -7,7 +7,7 @@ tag-template: jenkins-$NEXT_MINOR_VERSION
 
 template: |
   _This is an automatically generated changelog draft for Jenkins weekly releases.
-  See https://www.jenkins.io/changelog/ for the official changelogs._
+  See https://www.jenkins.io/changelog/#v$NEXT_MINOR_VERSION for the official changelog for this release, or https://www.jenkins.io/changelog-old/#v$NEXT_MINOR_VERSION for releases older than around 7 months._
 
   $CHANGES
 

.github/renovate.json

@@ -38,6 +38,24 @@
       "matchStrings": ["ARG MAVEN_VERSION=(?<currentValue>.*?)\n"],
       "depNameTemplate": "org.apache.maven:maven-core",
       "datasourceTemplate": "maven"
+    },
+    {
+      "fileMatch": ["core/src/site/site.xml"],
+      "matchStrings": ["lit@(?<currentValue>.*?)/"],
+      "depNameTemplate": "lit",
+      "datasourceTemplate": "npm"
+    },
+    {
+      "fileMatch": ["core/src/site/site.xml"],
+      "matchStrings": ["webcomponentsjs@(?<currentValue>.*?)/"],
+      "depNameTemplate": "@webcomponents/webcomponentsjs",
+      "datasourceTemplate": "npm"
+    },
+    {
+      "fileMatch": ["core/src/site/site.xml"],
+      "matchStrings": ["<version>(?<currentValue>.*?)<\/version>"],
+      "depNameTemplate": "org.apache.maven.skins:maven-fluido-skin",
+      "datasourceTemplate": "maven"
     }
   ],
   "labels": ["dependencies", "skip-changelog"],

.github/workflows/announce-lts-rc.yml

@@ -0,0 +1,30 @@
+name: Announce LTS RCs
+
+on:
+  release:
+    types: [prereleased]
+
+jobs:
+  post:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Post on Discourse
+        uses: roots/discourse-topic-github-release-action@fc9e50fa1a1ce6255ba4d03f104382845b79ad5f # v1.0.0
+        with:
+          discourse-api-key: ${{ secrets.DISCOURSE_RELEASES_API_KEY }}
+          discourse-base-url: https://community.jenkins.io/
+          discourse-author-username: jenkins-release-bot
+          discourse-category: 23
+      - name: Post on mailing list
+        uses: dawidd6/action-send-mail@v3
+        with:
+          server_address: smtp.gmail.com
+          server_port: 465
+          username: ${{secrets.MAIL_USERNAME}}
+          password: ${{secrets.MAIL_PASSWORD}}
+          secure: true
+          subject: ${{ github.event.release.tag_name }} has been released
+          to: [email protected]
+          from: Jenkins Release Bot
+          html_body: ${{ github.event.release.body }}
+          convert_markdown: true

.github/workflows/label-lts-prs.yaml

@@ -0,0 +1,23 @@
+name: Label PRs targeting LTS branches
+
+on: [pull_request_target]
+
+permissions:
+  pull-requests: write
+
+jobs:
+  label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if PR targets LTS branch
+        if: startsWith(github.event.pull_request.base.ref, 'stable-')
+        uses: actions/github-script@v6
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            github.rest.issues.addLabels({
+              owner: context.payload.repository.owner.login,
+              repo: context.payload.repository.name,
+              issue_number: context.payload.pull_request.number,
+              labels: ['into-lts']
+            });

.gitpod/Dockerfile

@@ -1,6 +1,6 @@
 FROM gitpod/workspace-full
 
-ARG MAVEN_VERSION=3.9.3
+ARG MAVEN_VERSION=3.9.4
 
 RUN brew install gh && \
     bash -c ". /home/gitpod/.sdkman/bin/sdkman-init.sh && sdk install maven ${MAVEN_VERSION} && sdk default maven ${MAVEN_VERSION}"

Jenkinsfile

@@ -14,7 +14,7 @@ properties([
 
 def axes = [
   platforms: ['linux', 'windows'],
-  jdks: [11, 17, 19],
+  jdks: [11, 17, 21],
 ]
 
 stage('Record build') {

ath.sh

@@ -6,7 +6,7 @@ set -o xtrace
 cd "$(dirname "$0")"
 
 # https://github.com/jenkinsci/acceptance-test-harness/releases
-export ATH_VERSION=5631.v2dcb_f66e58f7
+export ATH_VERSION=5699.v27deb_ef5796c
 
 if [[ $# -eq 0 ]]; then
 	export JDK=17

bom/pom.xml

@@ -40,7 +40,7 @@ THE SOFTWARE.
   <properties>
     <asm.version>9.5</asm.version>
     <slf4jVersion>2.0.7</slf4jVersion>
-    <stapler.version>1785.vf9cb_74a_b_ec5b_</stapler.version>
+    <stapler.version>1802.v9e2750160d01</stapler.version>
     <groovy.version>2.4.21</groovy.version>
   </properties>
 
@@ -56,15 +56,15 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>5.3.28</version>
+        <version>5.3.29</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
       <dependency>
         <!-- https://docs.spring.io/spring-security/site/docs/5.5.4/reference/html5/#getting-maven-no-boot -->
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-bom</artifactId>
-        <version>5.8.4</version>
+        <version>5.8.6</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>
@@ -82,7 +82,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>com.google.guava</groupId>
         <artifactId>guava</artifactId>
-        <version>32.1.1-jre</version>
+        <version>32.1.2-jre</version>
       </dependency>
       <dependency>
         <!-- Overriding Stapler’s 1.1.3 version to diagnose JENKINS-20618: -->
@@ -189,7 +189,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.apache.ant</groupId>
         <artifactId>ant</artifactId>
-        <version>1.10.13</version>
+        <version>1.10.14</version>
       </dependency>
       <dependency>
         <groupId>org.apache.commons</groupId>
@@ -260,7 +260,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.jvnet.hudson</groupId>
         <artifactId>commons-jelly-tags-define</artifactId>
-        <version>1.1-jenkins-20230124</version>
+        <version>1.1-jenkins-20230713</version>
       </dependency>
       <dependency>
         <groupId>org.jvnet.localizer</groupId>

core/pom.xml

@@ -654,7 +654,7 @@ THE SOFTWARE.
         <!-- Version specified in grandparent POM -->
         <configuration>
           <!-- Make sure to keep the directives in test/pom.xml and war/pom.xml in sync with these. -->
-          <argLine>@{jacocoSurefireArgs} --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.desktop/com.sun.beans.introspect=ALL-UNNAMED</argLine>
+          <argLine>@{jacocoSurefireArgs} --add-opens java.base/java.lang=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED</argLine>
           <reuseForks>false</reuseForks>
         </configuration>
       </plugin>
@@ -679,8 +679,8 @@ THE SOFTWARE.
     <plugins>
       <plugin>
         <!-- generate Jelly tag lib documentation -->
-        <groupId>org.kohsuke.stapler</groupId>
-        <artifactId>maven-stapler-plugin</artifactId>
+        <groupId>io.jenkins.tools.maven</groupId>
+        <artifactId>stapler-maven-plugin</artifactId>
         <!-- Version specified in grandparent POM -->
         <configuration>
           <patterns>

core/src/main/java/hudson/AbstractMarkupText.java

@@ -83,7 +83,7 @@ public final int length() {
      * @since 1.349
      */
     public void addHyperlink(int startPos, int endPos, String url) {
-        addMarkup(startPos, endPos, "<a href='" + url + "'>", "</a>");
+        addMarkup(startPos, endPos, "<a href='" + Functions.htmlAttributeEscape(url) + "'>", "</a>");
     }
 
     /**
@@ -93,7 +93,7 @@ public void addHyperlink(int startPos, int endPos, String url) {
      * @since 1.395
      */
     public void addHyperlinkLowKey(int startPos, int endPos, String url) {
-        addMarkup(startPos, endPos, "<a class='lowkey' href='" + url + "'>", "</a>");
+        addMarkup(startPos, endPos, "<a class='lowkey' href='" + Functions.htmlAttributeEscape(url) + "'>", "</a>");
     }
 
     /**

core/src/main/java/hudson/TcpSlaveAgentListener.java

@@ -314,6 +314,7 @@ private void respondHello(String header, Socket s) throws IOException {
                 if (header.startsWith("GET / ")) {
                     response = "HTTP/1.0 200 OK\r\n" +
                             "Content-Type: text/plain;charset=UTF-8\r\n" +
+                            "X-Content-Type-Options: nosniff\r\n" +
                             "\r\n" +
                             "Jenkins-Agent-Protocols: " + getAgentProtocolNames() + "\r\n" +
                             "Jenkins-Version: " + Jenkins.VERSION + "\r\n" +

core/src/main/java/hudson/Util.java

@@ -1927,4 +1927,29 @@ public static long daysElapsedSince(@NonNull Date date) {
     private static PathRemover newPathRemover(@NonNull PathRemover.PathChecker pathChecker) {
         return PathRemover.newFilteredRobustRemover(pathChecker, DELETION_RETRIES, GC_AFTER_FAILED_DELETE, WAIT_BETWEEN_DELETION_RETRIES);
     }
+
+    /**
+     * Returns SHA-256 Digest of input bytes
+     */
+    @Restricted(NoExternalUse.class)
+    public static byte[] getSHA256DigestOf(@NonNull byte[] input) {
+        try {
+                MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
+                messageDigest.update(input);
+                return messageDigest.digest();
+        } catch (NoSuchAlgorithmException noSuchAlgorithmException) {
+            throw new IllegalStateException("SHA-256 could not be instantiated, but is required to" +
+                    " be implemented by the language specification", noSuchAlgorithmException);
+        }
+    }
+
+    /**
+     * Returns Hex string of SHA-256 Digest of passed input
+     */
+    @Restricted(NoExternalUse.class)
+    public static String getHexOfSHA256DigestOf(byte[] input) throws IOException {
+        //get hex string of sha 256 of payload
+        byte[] payloadDigest = Util.getSHA256DigestOf(input);
+        return (payloadDigest != null) ? Util.toHexString(payloadDigest) : null;
+    }
 }

core/src/main/java/hudson/console/PlainTextConsoleOutputStream.java

@@ -28,6 +28,10 @@
 import java.io.DataInputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.charset.Charset;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.apache.commons.lang.StringEscapeUtils;
 
 /**
  * Filters out console notes.
@@ -36,6 +40,8 @@
  */
 public class PlainTextConsoleOutputStream extends LineTransformationOutputStream.Delegating {
 
+    private static final Logger LOGGER = Logger.getLogger(PlainTextConsoleOutputStream.class.getName());
+
     /**
      *
      */
@@ -64,7 +70,11 @@ protected void eol(byte[] in, int sz) throws IOException {
             int rest = sz - next;
             ByteArrayInputStream b = new ByteArrayInputStream(in, next, rest);
 
-            ConsoleNote.skip(new DataInputStream(b));
+            try {
+                ConsoleNote.skip(new DataInputStream(b));
+            } catch (IOException x) {
+                LOGGER.log(Level.FINE, "Failed to skip annotation from \"" + StringEscapeUtils.escapeJava(new String(in, next, rest, Charset.defaultCharset())) + "\"", x);
+            }
 
             int bytesUsed = rest - b.available(); // bytes consumed by annotations
             written += bytesUsed;

core/src/main/java/hudson/init/InitStrategy.java

@@ -9,6 +9,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.Comparator;
 import java.util.Iterator;
 import java.util.List;
 import java.util.ServiceLoader;
@@ -64,7 +65,11 @@ private void listPluginFiles(PluginManager pm, String extension, Collection<File
         if (files == null)
             throw new IOException("Jenkins is unable to create " + pm.rootDir + "\nPerhaps its security privilege is insufficient");
 
-        all.addAll(Arrays.asList(files));
+        List<File> pluginFiles = new ArrayList<>();
+        pluginFiles.addAll(List.of(files));
+        pluginFiles.sort(Comparator.comparing(File::getName));
+
+        all.addAll(pluginFiles);
     }
 
     /**
@@ -76,15 +81,16 @@ private void listPluginFiles(PluginManager pm, String extension, Collection<File
     protected void getBundledPluginsFromProperty(final List<File> r) {
         String hplProperty = SystemProperties.getString("hudson.bundled.plugins");
         if (hplProperty != null) {
+            List<File> pluginFiles = new ArrayList<>();
             for (String hplLocation : hplProperty.split(",")) {
                 File hpl = new File(hplLocation.trim());
                 if (hpl.exists()) {
-                    r.add(hpl);
+                    pluginFiles.add(hpl);
                 } else if (hpl.getName().contains("*")) {
                     try {
                         new DirScanner.Glob(hpl.getName(), null).scan(hpl.getParentFile(), new FileVisitor() {
                             @Override public void visit(File f, String relativePath) throws IOException {
-                                r.add(f);
+                                pluginFiles.add(f);
                             }
                         });
                     } catch (IOException x) {
@@ -94,6 +100,8 @@ protected void getBundledPluginsFromProperty(final List<File> r) {
                     LOGGER.warning("bundled plugin " + hplLocation + " does not exist");
                 }
             }
+            pluginFiles.sort(Comparator.comparing(File::getName));
+            r.addAll(pluginFiles);
         }
     }
 

core/src/main/java/hudson/model/DirectoryBrowserSupport.java

@@ -869,5 +869,5 @@ private static OpenOption[] getOpenOptions() {
     private static final Logger LOGGER = Logger.getLogger(DirectoryBrowserSupport.class.getName());
 
     @Restricted(NoExternalUse.class)
-    public static final String DEFAULT_CSP_VALUE = "sandbox; default-src 'none'; img-src 'self'; style-src 'self';";
+    public static final String DEFAULT_CSP_VALUE = "sandbox allow-same-origin; default-src 'none'; img-src 'self'; style-src 'self';";
 }

core/src/main/java/hudson/model/Label.java

@@ -592,10 +592,16 @@ public static Set<LabelAtom> parse(@CheckForNull String labels) {
         final Set<LabelAtom> r = new TreeSet<>();
         labels = fixNull(labels);
         if (labels.length() > 0) {
-            final QuotedStringTokenizer tokenizer = new QuotedStringTokenizer(labels);
-            while (tokenizer.hasMoreTokens())
-                r.add(Jenkins.get().getLabelAtom(tokenizer.nextToken()));
+            Jenkins j = Jenkins.get();
+            LabelAtom labelAtom = j.tryGetLabelAtom(labels);
+            if (labelAtom == null) {
+                final QuotedStringTokenizer tokenizer = new QuotedStringTokenizer(labels);
+                while (tokenizer.hasMoreTokens())
+                    r.add(j.getLabelAtom(tokenizer.nextToken()));
+            } else {
+                r.add(labelAtom);
             }
+        }
         return r;
     }
 

core/src/main/java/hudson/model/ManageJenkinsAction.java

@@ -79,13 +79,13 @@ public ContextMenu doContextMenu(StaplerRequest request, StaplerResponse respons
      * menu.
      */
     @Restricted(NoExternalUse.class)
-    public void addContextMenuItem(ContextMenu menu, String url, String icon, String iconXml, String text, boolean post, boolean requiresConfirmation, Badge badge) {
+    public void addContextMenuItem(ContextMenu menu, String url, String icon, String iconXml, String text, boolean post, boolean requiresConfirmation, Badge badge, String message) {
         if (Stapler.getCurrentRequest().findAncestorObject(this.getClass()) != null || !Util.isSafeToRedirectTo(url)) {
             // Default behavior if the URL is absolute or scheme-relative, or the current object is an ancestor (i.e. would resolve correctly)
-            menu.add(url, icon, iconXml, text, post, requiresConfirmation, badge);
+            menu.add(url, icon, iconXml, text, post, requiresConfirmation, badge, message);
             return;
         }
         // If neither is the case, rewrite the relative URL to point to inside the /manage/ URL space
-        menu.add("manage/" + url, icon, iconXml, text, post, requiresConfirmation, badge);
+        menu.add("manage/" + url, icon, iconXml, text, post, requiresConfirmation, badge, message);
     }
 }