[JIRA] (JENKINS-39360) Allow ALLOWED_JNLPJARS_FILES to be configurable by plugins

antoniobeyah@gmail.com (JIRA)

unread,

Oct 28, 2016, 2:12:04 PM10/28/16

to jenkinsc...@googlegroups.com

Antonio Beyah created an issue

Jenkins /

JENKINS-39360

Allow ALLOWED_JNLPJARS_FILES to be configurable by plugins

Issue Type:	Improvement
Assignee:	Kohsuke Kawaguchi
Components:	core, swarm-plugin
Created:	2016/Oct/28 6:11 PM
Priority:	Minor
Reporter:	Antonio Beyah

We currently use the [Swarm](https://wiki.jenkins-ci.org/display/JENKINS/Swarm+Plugin) plugin to configure our agents to connect to the master and one of the things we have to do is presetup the agent with the proper version of the swarm-client jar.

One thing I wanted to do was update the swarm plugin to allow you to retrieve the swarm-client.jar in the same manner as we can the slave.jar. When I looked at the code though I don't think this is possible due to the code in the core.

The current process looks like this:

Download swarm-client.jar from internet
Download slave.jar from master
Run java process with -cp slave.jar:swarm-client.jar

I would like it to look like:

Download swarm-client.jar from master
Download slave.jar from master
Run java process with -cp slave.jar:swarm-client.jar

End goal is to allow me to configure my agents by retrieving any necessary components from the master, including plugin client dependencies such as the swarm-client.jar.

References:
[Slave.java](https://github.com/jenkinsci/jenkins/blob/57fc2185da383e904a2a714f2d945426a92bfc3e/core/src/main/java/hudson/model/Slave.java#L619)
[Swarm Plugin](https://wiki.jenkins-ci.org/display/JENKINS/Swarm+Plugin)

Add Comment

This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c)

o.v.nenashev@gmail.com (JIRA)

unread,

Nov 10, 2016, 4:28:01 PM11/10/16

to jenkinsc...@googlegroups.com

Oleg Nenashev commented on

JENKINS-39360

Re: Allow ALLOWED_JNLPJARS_FILES to be configurable by plugins

Originally there was a plan to make it configurable, but the approach has been rejected by the Security team IIRC.
CC Daniel Beck

Add Comment

dbeck@cloudbees.com (JIRA)

unread,

Nov 10, 2016, 4:53:02 PM11/10/16

to jenkinsc...@googlegroups.com

Daniel Beck commented on

JENKINS-39360

Re: Allow ALLOWED_JNLPJARS_FILES to be configurable by plugins

I see no need to make this configurable. It should be straightforward to achieve a similar result with UnprotectedRootAction / DirectoryBrowserSupport (just don't be an idiot and allow path traversal). The approach chosen in Jenkins was to retain compatibility with existing URLs, but if it's a different file, it should be straightforward enough.