Hosting request for Zimperium zScan plugin

[exlegalalien]

Repository URL

https://github.com/Zimperium/zscan-plugin-jenkins

New Repository Name

zscan-upload-plugin

Description

The plugin uploads mobile builds to zScan for analysis and (optionally) downloads security and privacy assessment reports. While there are other mobile security scanning plugins in the marketplace, the upload process is specific to Zimperium and it is beneficial to have an official plugin for our cusotmers to use. More information: Zimperium zScan.

GitHub users to have commit permission

@Oliver-Zimperium
@exlegalalien

Jenkins project users to have release permission

legalalien
oliver_williams

Issue tracker

Jira

[jenkins-cert-app]

Security audit, information and commands

The security team is auditing all the hosting requests, to ensure a better security by default.

This message informs you that a Jenkins Security Scan was triggered on your repository.
It takes ~10 minutes to complete.

Commands

The bot will parse all comments, and it will check if any line start with a command.

Security team only:

• /audit-ok => the audit is complete, the hosting can continue 🎉.
• /audit-skip => the audit is not necessary, the hosting can continue 🎉.
• /audit-findings => the audit reveals some issues that require corrections ✏️.

Anyone:

• /request-security-scan => the findings from the Jenkins Security Scan were corrected, this command will re-scan your repository 🔍.
• /audit-review => the findings from the audit were corrected, this command will ping the security team to review the findings 👀. It's only applicable when the previous audit required changes.

Only one command can be requested per comment.

(automatically generated message, version: 1.29.12)

[github-actions]

Hello from your friendly Jenkins Hosting Checker

It appears you have some issues with your hosting request. Please see the list below and correct all issues marked Required. Your hosting request will not be approved until these issues are corrected. Issues marked with Warning or Info are just recommendations and will not stall the hosting process.

• ⛔ Required: You must specify an <scm> block in your pom.xml. See https://maven.apache.org/pom.html#SCM for more information.
• ⛔ Required: The following usernames in 'Jenkins project users to have release permission' need to log into Jira: oliver_williams (reports are re-synced hourly, wait to re-check for a bit after logging in)
• ⛔ Required: The following usernames in 'Jenkins project users to have release permission' need to log into Artifactory: legalalien, oliver_williams (reports are re-synced hourly, wait to re-check for a bit after logging in)
• ⛔ Required: The dependency com.google.code.gson:gson should be replaced with a dependency to the api plugin io.jenkins.plugins:gson-api

You can re-trigger a check by editing your hosting request or by commenting /hosting re-check

[jenkins-cert-app]

The Jenkins Security Scan discovered 4 finding(s) 🔍.

Please follow the instructions below for every identified issues:

• Implement the recommended fix to address the issue.
• If you think it's a false positive, suppress the warning directly within the code.
• Alternative, you write an explanation here about why you think it's irrelevant. That will require a manual review, leading to a slower process.

After addressing the findings through one of the above methods:

• If all modifications have been made to the code, please initiate a new security scan by triggering the /request-security-scan command.
• If there are any unresolved findings (those not corrected or suppressed), request a review from the Jenkins security team by using the /audit-review command.

---

Stapler: Missing permission check

You can find detailed information about this finding here.

ZDevUploadPlugin.java#548

Potential missing permission check in DescriptorImpl#doValidateCredentials

Jenkins: Plaintext password storage

You can find detailed information about this finding here.

LoginResponse.java#14

Field should be reviewed whether it stores a password and is serialized to disk: refreshToken

LoginResponse.java#10

Field should be reviewed whether it stores a password and is serialized to disk: accessToken

RefreshCredentials.java#5

Field should be reviewed whether it stores a password and is serialized to disk: refreshToken

[exlegalalien]

/request-security-scan

[jenkins-cert-app]

The Jenkins Security Scan did not find anything dangerous with your plugin, congratulations! 🎉

---

💡 The Security team recommends that you are setting up the scan in your repository by following our guide.

[exlegalalien]

/hosting re-check

[github-actions]

Hello from your friendly Jenkins Hosting Checker

It looks like you have everything in order for your hosting request. A member of the Jenkins hosting team will check over things that I am not able to check(code review, README content, etc) and process the request as quickly as possible. Thank you for your patience.

Hosting team members can host this request with /hosting host

[github-actions]

Hello from your friendly Jenkins Hosting Checker

It looks like you have everything in order for your hosting request. A member of the Jenkins hosting team will check over things that I am not able to check(code review, README content, etc) and process the request as quickly as possible. Thank you for your patience.

Hosting team members can host this request with /hosting host

[github-actions]

Hello from your friendly Jenkins Hosting Checker

It looks like you have everything in order for your hosting request. A member of the Jenkins hosting team will check over things that I am not able to check(code review, README content, etc) and process the request as quickly as possible. Thank you for your patience.

Hosting team members can host this request with /hosting host

[exlegalalien]

Hello Jenkins Hosting Team,

How can we move this request forward?

Thanks!

@timja @mawinter69 @NotMyFault

[daniel-beck]

https://github.com/Zimperium/zscan-plugin-jenkins/blob/472b13cff152e2d5a54f30325e807f5bdd00050d/src/main/java/com/zimperium/plugins/zDevJenkinsUploadPlugin/ZDevUploadPlugin.java#L589 is never correct. This permission may be granted, but it's too unspecific to check. Instances using plugins like https://plugins.jenkins.io/matrix-auth/ will only allow admins to take this action (which might be intentional, but it's not clear from the code).

You probably want one of the two approaches from https://www.jenkins.io/doc/developer/security/form-validation/#checking-permissions, depending on whether this appears in a job configuration, or the global configuration.

Also https://github.com/Zimperium/zscan-plugin-jenkins/blob/472b13cff152e2d5a54f30325e807f5bdd00050d/src/main/java/com/zimperium/plugins/zDevJenkinsUploadPlugin/ZDevUploadPlugin.java#L579 is now obsolete. The comment misses that Server-Side Request Forgery is a potential problem.

[exlegalalien]

@daniel-beck, thanks for the feedback!

• I'll update the permission check to use Item.CONFIGURE or Jenkins.ADMINISTRATOR, depending on the context.
• We have determined that SSRF risk is low: server response is not reflected back to the user. OKHttp client validates that the URL is http(s), thus disallowing file:// or other non-standard connections. A bigger issue is that there is no way for us to create an allowlist or denylist of destinations, as zScan consoles can be self-hosted. If required, outgoing connections can be firewalled through standard IT means.

Please let us know if additional changes are needed.

[exlegalalien]

/hosting re-check

[github-actions]

Hello from your friendly Jenkins Hosting Checker

It looks like you have everything in order for your hosting request. A member of the Jenkins hosting team will check over things that I am not able to check(code review, README content, etc) and process the request as quickly as possible. Thank you for your patience.

Hosting team members can host this request with /hosting host

[mawinter69]

You should annotate the Descriptor with e.g. @Symbol("zdevUpload"). This will be the step name in pipeline jobs.

[mawinter69]

Your Descriptor contains fields for a global configuration but you don't have a global.jelly that would allow to configure the fields. Also there is no code that would read those fields so they can be safely removed.

I think you're missing getter methods for the fields that are set via the constructor, without them when you configure the Recorder in a freestyle job it will not fill those fields in the UI.

[mawinter69]

In the readme you write that all the 3rd party jars are compiled with java17, I guess this applies to the retrofit things. If this is really the case then you must depend the plugin on 2.479.1 as minimum version as previous LTS versions of Jenkins are allowed to run with java11.

[mawinter69]

• https://github.com/Zimperium/zscan-plugin-jenkins/blob/7b772f79c970a9d6cd4a5a4ea5c54d079d128464/src/main/java/com/zimperium/plugins/zDevJenkinsUploadPlugin/ZDevUploadPlugin.java#L204, this will not work. The code here is executed on the controller, but when the job runs on an agent the FilePath path points to a file on the agent and file will point to a non existing file. To directly upload the file from the agent you can use path.act(...) (see https://javadoc.jenkins.io/hudson/FilePath.html). You should try to avoid to first transfer the file to the controller before uploading.

You should test your plugin in a setup where you have a real agent, that runs on a different machine than the controller.

[mawinter69]

one more thing to consider is that you do http request and in case a proxy is required they would fail. So you should read the ProxyConfiguration from Jenkins to check if a proxy is required and apply proxy settings accordingly.

[exlegalalien]

Thanks for the feedback, @mawinter69. I'll make the requested changes shortly and ask for another review.