jenkins CVE-2024-23897浅析

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

...
CLIConnectionFactory factory = new CLIConnectionFactory();
String userInfo = (new URL(url)).getUserInfo();
if (userInfo != null) {
    factory = factory.basicAuth(userInfo);
} else if (auth != null) {
    factory = factory.basicAuth(auth.startsWith("@") ? readAuthFromFile(auth).trim() : auth);
} else if (bearer != null) {
    factory = factory.bearerAuth(bearer.startsWith("@") ? readAuthFromFile(bearer).trim() : bearer);
}

if (mode == CLI.Mode.HTTP) {
    return plainHttpConnection(url, args, factory);
} else if (mode == CLI.Mode.WEB_SOCKET) {
    return webSocketConnection(url, args, factory);
} else {
    throw new AssertionError();
}
...

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

private String[] expandAtFiles(String[] args) throws CmdLineException {
    List<String> result = new ArrayList();
    String[] arr$ = args;
    int len$ = args.length;

    for(int i$ = 0; i$ < len$; ++i$) {
        String arg = arr$[i$];
        if (arg.startsWith("@")) {
            File file = new File(arg.substring(1));
            if (!file.exists()) {
                throw new CmdLineException(this, Messages.NO_SUCH_FILE, new String[]{file.getPath()});
            }

            try {
                result.addAll(readAllLines(file));
            } catch (IOException var9) {
                throw new CmdLineException(this, "Failed to parse " + file, var9);
            }
        } else {
            result.add(arg);
        }
    }

    return (String[])result.toArray(new String[result.size()]);
}