fixing SECURITY-1506 / CVE-2020-2249

[trivalik]

fix SECURITY-1506 / CVE-2020-2249 by using Secret class

[timja]

@keljos are you still around?

I believe this plugin is abandoned, and going down the adopt a plugin route is the most likely way to progress this: https://www.jenkins.io/doc/developer/plugin-governance/adopt-a-plugin/

[ev-psaad]

This is a big deal, because the TFS plugin hasn't been upgraded to remove the use of the commons-digester library, the plugin now stops working on Jenkins v2.297 (Weekly, 2021-06-08) or v2.303.1 (LTS, 2021-08-25).

No we have to choose between a vulnerable build of Jenkins, switching to Git, or removing the plugin and using the command line to interact with TFS?

[timja]

This is a big deal, because the TFS plugin hasn't been upgraded to remove the use of the commons-digester library, the plugin now stops working on Jenkins v2.297 (Weekly, 2021-06-08) or v2.303.1 (LTS, 2021-08-25).

No we have to choose between a vulnerable build of Jenkins, switching to Git, or removing the plugin and using the command line to interact with TFS?

Or adopting it :)

[trivalik]

There are also fixed out there to work without commons-digester. Here: glevy/tfs-plugin@2680aaf source is https://issues.jenkins.io/browse/JENKINS-65867

[ev-psaad]

I wish I could adopt it or even build a hpi file from source. Sadly I am a .NET developer. Can some kind soul provide a build of this PR or Glevy's fork?

[trivalik]

Its not hard to build (I am also just C# developer, but java is most same):

• install jdk 8 or higher
• install maven (if necessary setup proxy in repository configuration)
• then if JAVA_HOME is set to JDK, and Maven tool is accessable via PATH

Run unit tests:
mvn package -Dcheckstyle.skip -Dmaven.javadoc.skip=true

Do not run unit tests:
mvn package -Dcheckstyle.skip -Dmaven.javadoc.skip=true -DskipTests

[ev-psaad]

glevy came through, binary available here: https://github.com/glevy/tfs-plugin/releases/tag/commons-digester2