Adapt shouldParseRunParameter test to Jenkins 2.551#309
Merged
jimklimov merged 1 commit intoMar 10, 2026
Conversation
jenkinsci/jenkins@f92eadb in Jenkins 2.551 fixes Build information disclosure vulnerability through Run Parameter https://www.jenkins.io/security/advisory/2026-02-18/index.html#SECURITY-3658 That change requires that the build must exist before RunParameterValue is allowed to access the value of a parameter. This test is already using mock objects extensively. Allow the RunParameterValue job existence check to be skipped for one method call in shouldParseRunParameter so that the test does not need to be reworked to create and run a parameterized build. Detected in plugin BOM pull request: * jenkinsci/bom#6379 Testing done: * `mvn clean -Djenkins.version=2.551 -Dtest=BuildCommandTest test` fails without this change * `mvn clean -Djenkins.version=2.551 -Dtest=BuildCommandTest test` passes with this change * `mvn clean -Dtest=BuildCommandTest test` passes with or without this change
MarkEWaite
added a commit
to MarkEWaite/bom
that referenced
this pull request
Feb 18, 2026
MarkEWaite
added a commit
to jenkinsci/bom
that referenced
this pull request
Feb 18, 2026
Fixed by pull request: * jenkinsci/instant-messaging-plugin#309
renovate Bot
added a commit
to jenkinsci/bom
that referenced
this pull request
Feb 19, 2026
* Update dependency org.jenkins-ci.main:jenkins-war to v2.551 * Exclude instant-messaging test Fixed by pull request: * jenkinsci/instant-messaging-plugin#309 * Remove blue ocean leftovers Blue ocean is no longer tested with BOM --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Mark Waite <[email protected]>
jimklimov
approved these changes
Mar 10, 2026
jimklimov
left a comment
jimklimov
left a comment
Contributor
There was a problem hiding this comment.
LGTM, thanks (and sorry about the delay)!
Contributor
Author
Thanks. It needs a release of the plugin so that the new release can be included in the plugin BOM and the test exclusion can be removed from the plugin BOM. |
Contributor
|
Action launched now. I hoped labeling the PR would cause that automatically :) |
Contributor
|
Should ircbot be re-released with dependency on this new IM release too? |
Contributor
Author
|
You need to label it No need for a new release of the dependent plugin. |
MarkEWaite
added a commit
to jenkinsci/bom
that referenced
this pull request
Mar 25, 2026
renovate Bot
added a commit
to jenkinsci/bom
that referenced
this pull request
Mar 25, 2026
* Update dependency org.jenkins-ci.main:jenkins-war to v2.556 * Revert "Update dependency org.jenkins-ci.plugins:credentials to v1497 (#6503)" Fails git plugin test for credentials tracking. May cause other failures as well. This reverts commit 36c2bff. * Revert "Update dependency org.jenkins-ci.plugins:credentials to v1495 (#6494)" This reverts commit d249ed6. * Exclude +hudson.matrix.MatrixProjectTest.deletedLocked* * Use correct syntax for test exclusion * Stop exclusing instant-messaging test failure jenkinsci/instant-messaging-plugin#309 released --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Mark Waite <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adapt shouldParseRunParameter test to Jenkins 2.551
This commit in Jenkins 2.551 fixes Build information disclosure vulnerability through Run Parameter.
That change requires that the build must exist before RunParameterValue is allowed to access the value of a parameter.
This test is already using mock objects extensively. Allow the RunParameterValue job existence check to be skipped for one method call in shouldParseRunParameter so that the test does not need to be reworked to create and run a parameterized build.
Detected in plugin BOM pull request:
Needs to be merged and released before Jenkins 2.551 can be included in the plugin BOM. If not merged and released within the next few days, the BuildCommandTest will be ignored in plugin BOM so that the weekly plugin BOM can be released.
Testing done
mvn clean -Djenkins.version=2.551 -Dtest=BuildCommandTest testfails without this changemvn clean -Djenkins.version=2.551 -Dtest=BuildCommandTest testpasses with this changemvn clean -Dtest=BuildCommandTest testpasses with or without this changeSubmitter checklist