Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
JENKINS-74820 - forceSandBox - Hide command-launcher drop down from n…
…on-administrators (#103) * BEE-52312 - forceSandBox - Hide command-launcher drop down from non-administrators * BEE-52312 - forceSandBox - Hide command-launcher drop down from non-administrators * BEE-52312 - forceSandBox - Hide command-launcher drop down from non-administrators - Tests * BEE-52312 - forceSandBox - Hide command-launcher drop down from non-administrators - Tests * BEE-52312 - forceSandBox - Hide command-launcher drop down from non-administrators - Tests * BEE-52312 - forceSandBox - Hide command-launcher drop down from non-administrators - Tests * BEE-52312 - forceSandBox - Hide command-launcher drop down from non-administrators - Tests * BEE-52312 - forceSandBox - Hide command-launcher drop down from non-administrators - Tests * JENKINS-74820 - Apply suggestions from code review Co-authored-by: Antonio Muniz <[email protected]> * BEE-52312 - change constructor signature to avoid breaking changes. * BEE-52312 - bump pom version * JENKINS-74820 - Apply suggestions from code review Co-authored-by: Jesse Glick <[email protected]> * BEE-52312 - add pom dependecies * BEE-52312 - add pom dependecies * BEE-52312 - SuggestedChanges * BEE-52312 - SuggestedChanges - Test * BEE-52312 - final changes --------- Co-authored-by: Antonio Muniz <[email protected]> Co-authored-by: Jesse Glick <[email protected]>
- Loading branch information
3 people
authored
Nov 12, 2024
1 parent
d8b301c
commit d85919c
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,202 @@ | ||
| package hudson.slaves; | ||
|
|
||
| import java.io.IOException; | ||
|
|
||
| import org.htmlunit.html.HtmlForm; | ||
| import org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval; | ||
| import org.junit.Before; | ||
| import org.junit.Rule; | ||
| import org.junit.Test; | ||
| import org.jvnet.hudson.test.JenkinsRule; | ||
| import org.jvnet.hudson.test.JenkinsRule.WebClient; | ||
| import org.jvnet.hudson.test.MockAuthorizationStrategy; | ||
|
|
||
| import hudson.model.Computer; | ||
| import hudson.model.Descriptor; | ||
| import hudson.model.User; | ||
| import hudson.security.ACL; | ||
| import hudson.security.ACLContext; | ||
| import jenkins.model.Jenkins; | ||
|
|
||
| import static org.junit.Assert.assertEquals; | ||
| import static org.junit.Assert.assertFalse; | ||
| import static org.junit.Assert.assertThrows; | ||
| import static org.junit.Assert.assertTrue; | ||
|
|
||
| public class CommandLauncherForceSandboxTest { | ||
|
|
||
| @Rule | ||
| public JenkinsRule j = new JenkinsRule(); | ||
|
|
||
| @Before | ||
| public void configureTest() throws IOException { | ||
| Jenkins.MANAGE.setEnabled(true); | ||
|
|
||
| j.jenkins.setSecurityRealm(j.createDummySecurityRealm()); | ||
|
|
||
| MockAuthorizationStrategy strategy = new MockAuthorizationStrategy(). | ||
| grant(Jenkins.ADMINISTER).everywhere().to("admin"). | ||
| grant(Jenkins.MANAGE).everywhere().to("devel"). | ||
| grant(Jenkins.READ, Computer.CONFIGURE).everywhere().to("devel"); | ||
|
|
||
| SlaveComputer.PERMISSIONS.getPermissions().forEach(p -> strategy.grant(p).everywhere().to("devel")); | ||
|
|
||
| j.jenkins.setAuthorizationStrategy(strategy); | ||
| } | ||
|
|
||
| @Test | ||
| public void newCommandLauncher() throws Exception { | ||
| try (ACLContext ctx = ACL.as(User.getById("devel", true))) { | ||
| //With forceSandbox enabled, nonadmin users should not create agents with Launcher = CommandLauncher | ||
| ScriptApproval.get().setForceSandbox(true); | ||
| Descriptor.FormException ex = assertThrows(Descriptor.FormException.class, () -> | ||
| new DumbSlave("s", "/",new CommandLauncher("echo unconfigured"))); | ||
|
|
||
| assertEquals("This Launch Method requires scripts executions out of the sandbox." | ||
| + " This Jenkins instance has been configured to not allow regular users to disable the sandbox", | ||
| ex.getMessage()); | ||
|
|
||
| //With forceSandbox disabled, nonadmin users can create agents with Launcher = CommandLauncher | ||
| ScriptApproval.get().setForceSandbox(false); | ||
| new DumbSlave("s", "/", new CommandLauncher("echo unconfigured")); | ||
| } | ||
|
|
||
| try (ACLContext ctx = ACL.as(User.getById("admin", true))) { | ||
| //admin users can create agents with Launcher = CommandLauncher independently of forceSandbox flag. | ||
| ScriptApproval.get().setForceSandbox(true); | ||
| new DumbSlave("s", "/", new CommandLauncher("echo unconfigured")); | ||
|
|
||
| ScriptApproval.get().setForceSandbox(false); | ||
| new DumbSlave("s", "/", new CommandLauncher("echo unconfigured")); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void editCommandLauncherUI_ForceSandboxTrue() throws Exception { | ||
| ScriptApproval.get().setForceSandbox(true); | ||
|
|
||
| DumbSlave commandLauncherAgent = new DumbSlave("commandLauncherAgent", "/", new CommandLauncher("echo unconfigured")); | ||
| DumbSlave noCommandLauncherAgent = new DumbSlave("noCommandLauncherAgent", "/", new JNLPLauncher()); | ||
| j.jenkins.addNode(commandLauncherAgent); | ||
| j.jenkins.addNode(noCommandLauncherAgent); | ||
|
|
||
| try (WebClient wc = j.createWebClient().login("devel")) { | ||
| //Edit noCommandLauncher Agent. | ||
| //We are not admin and Sandbox is true, | ||
| //We don't have any html object for CommandLauncher | ||
| HtmlForm form = wc.getPage(noCommandLauncherAgent, "configure").getFormByName("config"); | ||
| assertTrue(form.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
|
|
||
| //Edit CommandLauncher Agent. | ||
| //We are not admin and Sandbox is true | ||
| // As the agent is already a commandLauncher one we have some html object for CommandLauncher | ||
| form = wc.getPage(commandLauncherAgent, "configure").getFormByName("config"); | ||
| assertFalse(form.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
| } | ||
|
|
||
| try (WebClient wc = j.createWebClient().login("admin")) { | ||
| //Edit noCommandLauncher Agent. | ||
| //We areadmin and Sandbox is true, | ||
| //We have some html object for CommandLauncher | ||
| HtmlForm form = wc.getPage(noCommandLauncherAgent, "configure").getFormByName("config"); | ||
| assertFalse(form.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
|
|
||
| //Edit CommandLauncher Agent. | ||
| //Wwe not admin and Sandbox is true | ||
| //We have some html object for CommandLauncher | ||
| form = wc.getPage(commandLauncherAgent, "configure").getFormByName("config"); | ||
| assertFalse(form.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
| } } | ||
|
|
||
| @Test | ||
| public void editCommandLauncherUI_ForceSandboxFalse() throws Exception { | ||
| ScriptApproval.get().setForceSandbox(false); | ||
|
|
||
| DumbSlave commandLauncherAgent = new DumbSlave("commandLauncherAgent", "/", new CommandLauncher("echo unconfigured")); | ||
| DumbSlave noCommandLauncherAgent = new DumbSlave("noCommandLauncherAgent", "/", new JNLPLauncher()); | ||
| j.jenkins.addNode(commandLauncherAgent); | ||
| j.jenkins.addNode(noCommandLauncherAgent); | ||
|
|
||
| try (WebClient wc = j.createWebClient().login("devel")) { | ||
| //Edit noCommandLauncher Agent. | ||
| //We are not admin and Sandbox is false, | ||
| //We have some html object for CommandLauncher | ||
| HtmlForm form = wc.getPage(noCommandLauncherAgent, "configure").getFormByName("config"); | ||
| assertFalse(form.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
|
|
||
| //Edit CommandLauncher Agent. | ||
| //Wwe are not admin and Sandbox is false | ||
| //We have some html object for CommandLauncher | ||
| form = wc.getPage(commandLauncherAgent, "configure").getFormByName("config"); | ||
| assertFalse(form.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
| } | ||
|
|
||
| try (WebClient wc = j.createWebClient().login("admin")) { | ||
| //Edit noCommandLauncher Agent. | ||
| //We areadmin and Sandbox is false, | ||
| //We have some html object for CommandLauncher | ||
| HtmlForm form = wc.getPage(noCommandLauncherAgent, "configure").getFormByName("config"); | ||
| assertFalse(form.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
|
|
||
| //Edit CommandLauncher Agent. | ||
| //Wwe not admin and Sandbox is false | ||
| //We have some html object for CommandLauncher | ||
| form = wc.getPage(commandLauncherAgent, "configure").getFormByName("config"); | ||
| assertFalse(form.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void createCommandLauncherUI_ForceSandboxTrue() throws Exception { | ||
| ScriptApproval.get().setForceSandbox(true); | ||
|
|
||
| try (WebClient wc = j.createWebClient().login("devel")) { | ||
| //Create Permanent Agent. | ||
| //We are not admin and Sandbox is true, | ||
| //We don't have any html object for CommandLauncher | ||
| HtmlForm form = wc.goTo("computer/new").getFormByName("createItem"); | ||
| form.getInputByName("name").setValue("devel_ComandLauncher"); | ||
| form.getInputsByValue(DumbSlave.class.getName()).stream().findFirst().get().setChecked(true); | ||
| HtmlForm createNodeForm = j.submit(form).getFormByName("config"); | ||
| assertTrue(createNodeForm.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
| } | ||
|
|
||
| try (WebClient wc = j.createWebClient().login("admin")) { | ||
| //Create Permanent Agent. | ||
| //We are admin and Sandbox is true, | ||
| //We have some html object for CommandLauncher | ||
| HtmlForm form = wc.goTo("computer/new").getFormByName("createItem"); | ||
| form.getInputByName("name").setValue("devel_ComandLauncher"); | ||
| form.getInputsByValue(DumbSlave.class.getName()).stream().findFirst().get().setChecked(true); | ||
| HtmlForm createNodeForm = j.submit(form).getFormByName("config"); | ||
| assertFalse(createNodeForm.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
| } | ||
| } | ||
|
|
||
| @Test | ||
| public void createCommandLauncherUI_ForceSandboxFalse() throws Exception { | ||
| ScriptApproval.get().setForceSandbox(false); | ||
|
|
||
| try (WebClient wc = j.createWebClient().login("devel")) { | ||
| //Create Permanent Agent. | ||
| //We are not admin and Sandbox is false, | ||
| //We have some html object for CommandLauncher | ||
| HtmlForm form = wc.goTo("computer/new").getFormByName("createItem"); | ||
| form.getInputByName("name").setValue("devel_ComandLauncher"); | ||
| form.getInputsByValue(DumbSlave.class.getName()).stream().findFirst().get().setChecked(true); | ||
| HtmlForm createNodeForm = j.submit(form).getFormByName("config"); | ||
| assertFalse(createNodeForm.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
| } | ||
|
|
||
| try (WebClient wc = j.createWebClient().login("admin")) { | ||
| //Create Permanent Agent. | ||
| //We are admin and Sandbox is true, | ||
| //We have some html object for CommandLauncher | ||
| HtmlForm form = wc.goTo("computer/new").getFormByName("createItem"); | ||
| form.getInputByName("name").setValue("devel_ComandLauncher"); | ||
| form.getInputsByValue(DumbSlave.class.getName()).stream().findFirst().get().setChecked(true); | ||
| HtmlForm createNodeForm = j.submit(form).getFormByName("config"); | ||
| assertFalse(createNodeForm.getInputsByValue(CommandLauncher.class.getName()).isEmpty()); | ||
| } | ||
| } | ||
| } |