[JIRA] (JENKINS-53752) Block PRs from forks from untrusted users

[samsch@microsoft.com (JIRA)]

Sam Schwarz created an issue

Jenkins / JENKINS-53752 Block PRs from forks from untrusted users Issue Type: New Feature Assignee: Unassigned Components: github-branch-source-plugin Created: 2018-09-24 17:15 Labels: security configuration Priority: Major Reporter: Sam Schwarz The plugin currently has no way to block untrusted users from making a PR from a fork and having this PR built by Jenkins. The GitHub Pull Request Builder does have this feature which is very useful for open source projects to protect the build system from malicious changes. The documentation on the GitHub Pull Request Builder wiki page says to move from the GHPRB plugin to the GitHub Branch source plugin which causes the user to lose this extremely useful functionality. Add Comment

This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

[mark.earl.waite@gmail.com (JIRA)]

Mark Waite updated an issue

Jenkins / JENKINS-53752 Block PRs from forks from untrusted users

Change By: Mark Waite Attachment: github-branch-source-discover-pull-requests.PNG

Add Comment

[mark.earl.waite@gmail.com (JIRA)]

Mark Waite commented on JENKINS-53752

Re: Block PRs from forks from untrusted users Isn't the option to "Discover pull requests from forks" what you are seeking, with the setting "From Users with Admin or Write permission"?

Add Comment

[directhex@apebox.org (JIRA)]

Jo Shields commented on JENKINS-53752

Re: Block PRs from forks from untrusted users

No. That's the point. That setting determines whether pull requests should use Jenkinsfile from origin/ or from the fork - it has no functionality to block pull requests from users under any circumstance.

Add Comment

[andrew.bayer@gmail.com (JIRA)]

Andrew Bayer commented on JENKINS-53752

Re: Block PRs from forks from untrusted users

Yeah, this is a missing feature - I'm trying to figure out if it's missing by design for some reason.

Add Comment

[andrew.bayer@gmail.com (JIRA)]

Andrew Bayer assigned an issue to Andrew Bayer

Jenkins / JENKINS-53752

Block PRs from forks from untrusted users

Change By: Andrew Bayer Assignee: Andrew Bayer

Add Comment

[andrew.bayer@gmail.com (JIRA)]

Andrew Bayer started work on JENKINS-53752

Change By: Andrew Bayer Status: Open In Progress

Add Comment

[andrew.bayer@gmail.com (JIRA)]

Andrew Bayer updated JENKINS-53752

Jenkins / JENKINS-53752 Block PRs from forks from untrusted users

Change By: Andrew Bayer Status: In Progress Review

Add Comment

[andrew.bayer@gmail.com (JIRA)]

Andrew Bayer commented on JENKINS-53752

Re: Block PRs from forks from untrusted users Preliminary PR up at https://github.com/jenkinsci/github-branch-source-plugin/pull/188 - we'll see what the reviewers think of it.

Add Comment

[vivek.pandey@gmail.com (JIRA)]

Vivek Pandey assigned an issue to rsandell

Jenkins / JENKINS-53752

Block PRs from forks from untrusted users

Change By: Vivek Pandey Assignee: Andrew Bayer rsandell

Add Comment

[brian.murrell@intel.com (JIRA)]

Brian J Murrell commented on JENKINS-53752

Re: Block PRs from forks from untrusted users Any word on the status of this? I would add one more feature to allow those with write or perhaps just admin privileges to approve "untrusted" PRs.

Add Comment

[brian.murrell@intel.com (JIRA)]

Brian J Murrell commented on JENKINS-53752

Re: Block PRs from forks from untrusted users

Will any further work be done on this or should this issue be closed?

Add Comment

[bitwiseman@gmail.com (JIRA)]

Liam Newman assigned an issue to Liam Newman

Jenkins / JENKINS-53752

Block PRs from forks from untrusted users

Change By: Liam Newman Assignee: rsandell Liam Newman

Add Comment

[brian.murrell@intel.com (JIRA)]

Brian J Murrell updated an issue

Jenkins / JENKINS-53752 Block PRs from forks from untrusted users

Change By: Brian J Murrell Attachment: image-2019-07-23-10-28-00-893.png

Add Comment

[brian.murrell@intel.com (JIRA)]

Brian J Murrell commented on JENKINS-53752

Re: Block PRs from forks from untrusted users Isn't this option: supposed to achieve what is being asked for in this ticket?

Add Comment

[oxygenxo@gmail.com (JIRA)]

Andrey Babushkin commented on JENKINS-53752

Re: Block PRs from forks from untrusted users

Brian J Murrell, no, it isn't because it blocks only Jenkinsfile changes (it will be taken from PR's target branch, not source) and still executes it.  Therefore any user who can open a PR in your repository can easily modify build scripts/CMake files and gain access to your build systems

Add Comment

[brian.murrell@intel.com (JIRA)]

Brian J Murrell commented on JENKINS-53752

Re: Block PRs from forks from untrusted users

Andrey Babushkin That's not at all how the item description or help text reads.  It very specifically says it will only build a change request / pull request ...

Add Comment

[oxygenxo@gmail.com (JIRA)]

Andrey Babushkin commented on JENKINS-53752

Re: Block PRs from forks from untrusted users

I'm sorry Brian J Murrell, It seems I've just screwed the config of my GitHub Organization folder. I've set "Build strategies" like on the picture you've provided and "Trust" to "Nobody". Jenkins creates jobs for PRs opened by untrusted persons, but doesn't run them. That's exactly what I've needed, thank you

Add Comment

[bitwiseman@gmail.com (JIRA)]

Liam Newman updated JENKINS-53752

This is fixed and the feature provided by a plugin

Jenkins / JENKINS-53752

Block PRs from forks from untrusted users

Change By: Liam Newman Status: In Review Resolved Resolution: Fixed

Add Comment

[brian.murrell@intel.com (JIRA)]

Brian J Murrell commented on JENKINS-53752

Re: Block PRs from forks from untrusted users Liam Newman Could you provide some more details?  Which plugin, at least.

Add Comment

[brian.murrell@intel.com (JIRA)]

Brian J Murrell commented on JENKINS-53752

Re: Block PRs from forks from untrusted users

Liam Newman Perhaps you are referring to [#188| https://github.com/jenkinsci/github-branch-source-plugin/pull/188]. If so I would direct you to the last comment there about JENKINS-58618 and JENKINS-58683, neither of which have even been triaged.

Add Comment