zuul
/
zuul
Code Issues Proposed changes
zuul/tests/fixtures/config
History
Tobias Henkel 9cbb681446
Fix plugin injection vulnerability 
Currently it is possible to inject speculative plugins into untrusted
jobs. These plugins are run locally on the executor and make it
possible to run arbitraty code within the bwrap context.

There are two problems here. First the path check is broken such it
never matches a plugin dir. Further we don't check paths residing
within playbook dirs.

Change-Id: Idf1b940de2be7819afeb2dbad943fad2ae7ebc55
 		2018-03-16 18:12:35 +01:00
..
abstract Add abstract job attribute 2018-02-12 15:35:54 -08:00
allowed-projects Don't override allowed-projects 2018-01-26 14:28:46 -08:00
ansible Remove support for erroneous host_vars and group_vars 2018-02-20 13:56:40 -08:00
base-jobs Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
branch-deletion Fix branch deletion after failed reconfig 2018-02-14 14:26:31 -08:00
branch-mismatch Use override-checkout to select jobs 2018-01-24 13:06:04 -08:00
branch-negative Fix complex branch matchers in project configs 2017-12-01 15:25:13 -08:00
branch-tag Fix implied branch matchers and tags 2017-12-01 15:54:24 -08:00
branch-templates Combine branch templates and pipeline branch matchers 2017-11-28 14:07:14 -08:00
branch-variants Update playbook paths with extension 2017-12-05 14:25:07 +11:00
broken Case sensitive label matching 2017-07-27 07:46:35 +02:00
central-jobs Add multi-branch support for project-templates 2017-10-27 13:41:25 -07:00
conflict-config Require a base job 2017-08-07 14:52:37 -07:00
cross-source Add cross-source tests 2018-01-16 09:37:59 -08:00
data-return Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
dependency-graph Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
disk-accountant Sync when doing disk accountant testing 2018-02-06 15:03:04 -08:00
duplicate-pipeline Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
final Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
git-driver Git driver 2017-12-15 14:32:40 +01:00
governor Executor: Don't start too many jobs at once 2018-02-02 11:36:49 -08:00
implicit-project Add implicit project name matching 2017-12-22 10:09:28 +01:00
implicit-roles Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
in-repo Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
in-repo-join Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
inventory Add specific setup inventory 2017-12-28 18:13:44 +01:00
job-output Update playbook paths with extension 2017-12-05 14:25:07 +11:00
merge-modes/git/common-config/playbooks Merge "Add playbooks for all test jobs" into feature/zuulv3 2017-02-06 16:45:58 +00:00
merges Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
multi-driver Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
multi-tenant Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
multi-tenant-semaphore Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
nodesets Handle nodesets in branches 2018-01-18 13:38:13 -08:00
openstack Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
post-playbook Update playbook paths with extension 2017-12-05 14:25:07 +11:00
pragma Add pragma directive 2017-10-26 14:28:03 -07:00
pragma-multibranch Add implied-branches pragma directive 2017-12-13 16:06:34 -08:00
pre-playbook Update playbook paths with extension 2017-12-05 14:25:07 +11:00
protected Add support for protected jobs 2017-12-15 19:31:02 +01:00
push-reqs Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
remote-action-modules Generate symlinks during tests 2018-03-15 11:55:20 +01:00
remote-zuul-json Fix no_log bug with result lists 2018-03-15 09:45:55 -07:00
requirements Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
roles Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
secret-inheritance Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
secret-leaks Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
secrets Handle secrets in branches 2018-01-18 13:38:02 -08:00
semaphore Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
semaphore-branches Normalize semaphore branch handling 2018-01-18 14:53:15 -08:00
shadow Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
single-tenant Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
speculative-plugins Fix plugin injection vulnerability 2018-03-16 18:12:35 +01:00
split-config Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
sql-driver Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
streamer Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
success-url Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
templated-project Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
tenant-parser Do not call merger:cat when all config items are excluded 2018-02-07 12:12:25 +01:00
unprotected-branches Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
zuul-connections-multiple-gerrits Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
zuul-connections-same-gerrit Update test fixtures to use explicit run 2017-10-26 15:59:41 -07:00
zuultrigger Merge "Re-enable test_zuul_trigger_project_change_merged" into feature/zuulv3 2017-11-29 17:57:32 +00:00