{"push_id":788393458,"size":1000,"distinct_size":395,"ref":"refs/heads/master","head":"aaa71d4feb1f4ce1c477ac03c9fc6df543cca84b","before":"9f6be6306e1288af1289b623bd512fee8e56119d","commits":[{"sha":"318627de88d622a1a5167c0f14fbc423f4fd5a44","author":{"email":"f03f7b035106bba3da9b565be6f0115dc0d88f87@cloudbees.com","name":"Jesse Glick"},"message":"Updated help-useBrowser.html.\n\nIn 20340e1842317f2564abd59d15eb2c958892f526 @daniel-beck suggested updating this text.","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/318627de88d622a1a5167c0f14fbc423f4fd5a44"},{"sha":"889b46cc9146fda468023f3ada71070e240c13ac","author":{"email":"f03f7b035106bba3da9b565be6f0115dc0d88f87@cloudbees.com","name":"Jesse Glick"},"message":"Merge pull request #2 from jenkinsci-cert/SECURITY-163\n\n[SECURITY-163] Non-browser-based DownloadService","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/889b46cc9146fda468023f3ada71070e240c13ac"},{"sha":"97ad2e087b95a132a48b2aa35f284406e0f205b1","author":{"email":"f03f7b035106bba3da9b565be6f0115dc0d88f87@cloudbees.com","name":"Jesse Glick"},"message":"Merge branch 'rc' into security-rc","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/97ad2e087b95a132a48b2aa35f284406e0f205b1"},{"sha":"67f338507dc5b41c880066276367d9e4023e9f53","author":{"email":"f03f7b035106bba3da9b565be6f0115dc0d88f87@cloudbees.com","name":"Jesse Glick"},"message":"Merge branch 'security' into security-rc\n\nConflicts:\n\tcore/src/main/java/hudson/model/DownloadService.java\n\tcore/src/main/java/hudson/model/UpdateSite.java\n\tcore/src/main/java/jenkins/model/DownloadSettings.java\n\tcore/src/main/java/jenkins/util/JSONSignatureValidator.java\n\tcore/src/main/resources/hudson/model/UpdateCenter/PageDecoratorImpl/footer.jelly\n\tcore/src/main/resources/jenkins/model/DownloadSettings/config.groovy\n\tcore/src/main/resources/jenkins/model/DownloadSettings/help-useBrowser.html\n\ttest/src/test/java/hudson/model/DownloadServiceTest.java","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/67f338507dc5b41c880066276367d9e4023e9f53"},{"sha":"77bc6ad835fc0fc54e4fed16395deb24332a2b49","author":{"email":"60c6d277a8bd81de7fdde19201bf9c58a3df08f4@bedatadriven.com","name":"Alex Bertram"},"message":"JENKINS-26604 Removes try-catch from GlobalSettingsProvider unhelpfully which swallows exceptions\n\nIf there is a problem providing the Maven global settings file configured by the user, the build\nshould end in error. This is the behavior of SettingsProvider but not of GlobalSettingsProvider, which\nwas swallowing the exception and printing only a warning, without details of the exception.","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/77bc6ad835fc0fc54e4fed16395deb24332a2b49"},{"sha":"eaaf1fcf45e8437725f8adca27223fcb8addd9c7","author":{"email":"f03f7b035106bba3da9b565be6f0115dc0d88f87@cloudbees.com","name":"Jesse Glick"},"message":"Merge branch 'rc' into security-rc","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/eaaf1fcf45e8437725f8adca27223fcb8addd9c7"},{"sha":"59bd031487697ea46c4fcb6c4cc3d0d82c06f950","author":{"email":"de3b012491526ae1f8b29aa85aa6c8cbf30e42b6@patbos.com","name":"Patrik Boström"},"message":"JENKINS-26723 Expose displayName in Remote API","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/59bd031487697ea46c4fcb6c4cc3d0d82c06f950"},{"sha":"d6e14b1eca6cb0ba406308a79f442196f1fd8b45","author":{"email":"115d76c8cc99809e23c5b0501f06ca4cb7582e64@cloudbees.com","name":"James Nord"},"message":"[SECURITY-167] defend against XXE attacks.\n\nAdded a new EntityResolver that will throw an exception if any attempts\nare made to load external entities.\nMade the transforer use SAX so that we can use out EntityResolover.\n\nAs we can't defend against calls that have already parsed the xml (e.g.\nDOMSource) if we are parsed one of those throw an exception (which can be\ndisabled with a System property.","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/d6e14b1eca6cb0ba406308a79f442196f1fd8b45"},{"sha":"c58ea9fe79486f3998f5698262c6bae4646e35d3","author":{"email":"115d76c8cc99809e23c5b0501f06ca4cb7582e64@cloudbees.com","name":"James Nord"},"message":"[SECURITY-167] attempt to set JAXP properties.\n\nAtempt to set SAX specific properties to defend against XXE attacks.","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/c58ea9fe79486f3998f5698262c6bae4646e35d3"},{"sha":"2a1b8542cb6a9b9f7d9508711dcb45c4c7599ddb","author":{"email":"115d76c8cc99809e23c5b0501f06ca4cb7582e64@cloudbees.com","name":"James Nord"},"message":"[SECURITY-167] fix failing unit test.","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/2a1b8542cb6a9b9f7d9508711dcb45c4c7599ddb"},{"sha":"b579a53cfd8cda22691ffbf8afa0fdde5298eb0a","author":{"email":"115d76c8cc99809e23c5b0501f06ca4cb7582e64@cloudbees.com","name":"James Nord"},"message":"[SECURITY-167] update log message when prevention is disabled.\n\nadd stack trace so the offending plugin/code can be identified","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/b579a53cfd8cda22691ffbf8afa0fdde5298eb0a"},{"sha":"01a087d127d7a871eac02b03143464e2f4c6d48c","author":{"email":"3abae44b563f13ec7dd58e31e8573cb075e6a5e9@gmail.com","name":"Ryan Campbell"},"message":"[SECURITY-166] Prevent the creation of anonymous, system or unknown users.\n\nThese users can still be instantiated, as would happen if there is no security and an anonymous user triggers a build -- the anonymous user would correctly be created and added to the User list. This fix merely prevents the saving of that user, and therefore prevents them from logging in.\n\nThere may be some plugins which trigger a build as the SYSTEM user, and that is not prohibited here.\n\nAlso prevent full names of 'anonymous', 'system' or 'uknown'. As discussed on SECURITY-166 this may encumber auditing since full names are used in most places in the UI","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/01a087d127d7a871eac02b03143464e2f4c6d48c"},{"sha":"09c04e3b666ef0832201d4433326b35b4bf84991","author":{"email":"3abae44b563f13ec7dd58e31e8573cb075e6a5e9@gmail.com","name":"Ryan Campbell"},"message":"Resolve feedback on SECURITY-165","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/09c04e3b666ef0832201d4433326b35b4bf84991"},{"sha":"71f9d5ebf4a46ceb5c906df3bf693cc5cc05f1c7","author":{"email":"3abae44b563f13ec7dd58e31e8573cb075e6a5e9@gmail.com","name":"Ryan Campbell"},"message":"[SECURITY-165] Add constants for system-wide usernames","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/71f9d5ebf4a46ceb5c906df3bf693cc5cc05f1c7"},{"sha":"7d926f720ea2d86ad60556a56ae1c7241b5392b7","author":{"email":"f03f7b035106bba3da9b565be6f0115dc0d88f87@cloudbees.com","name":"Jesse Glick"},"message":"Removing hudson.matrix classes and associated resources as a first pass.\n\n(cherry picked from commit 4aad749cbe282ef33134ea924a4e547c4767ca07)\n\nConflicts:\n\tcore/src/main/java/hudson/matrix/MatrixBuild.java\n\tcore/src/main/java/hudson/matrix/MatrixConfiguration.java\n\tcore/src/main/java/hudson/matrix/MatrixProject.java\n\tcore/src/main/resources/hudson/matrix/MatrixProject/configure-entries.jelly","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/7d926f720ea2d86ad60556a56ae1c7241b5392b7"},{"sha":"17ba1dad1f8229b7650e8cbb6cc91ddf89aebe10","author":{"email":"f03f7b035106bba3da9b565be6f0115dc0d88f87@cloudbees.com","name":"Jesse Glick"},"message":"Comment, but not critical for separation.\n(cherry picked from commit e405078e093dac71daeff8576ebccdcf27b718ba)","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/17ba1dad1f8229b7650e8cbb6cc91ddf89aebe10"},{"sha":"bf2cd1a689e7e0e451fdaf17a217dcc6a1369f28","author":{"email":"f03f7b035106bba3da9b565be6f0115dc0d88f87@cloudbees.com","name":"Jesse Glick"},"message":"isMatrixProject appears unused, but keep for compatibility.\n(cherry picked from commit d72fda46a6a5f521a986dc770afffc89e862c52b)","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/bf2cd1a689e7e0e451fdaf17a217dcc6a1369f28"},{"sha":"5a9b69d2fca6457b301d631744026659b70e782a","author":{"email":"f03f7b035106bba3da9b565be6f0115dc0d88f87@cloudbees.com","name":"Jesse Glick"},"message":"XStream initializations moved to MatrixProject.\n(cherry picked from commit dbed3044070cb95fc3e7b5cabaddcf88cf65aaf2)\n\nConflicts:\n\tcore/src/main/java/hudson/model/Run.java","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/5a9b69d2fca6457b301d631744026659b70e782a"},{"sha":"1b47215e68e0126b2e4e845b5f8842771c75073c","author":{"email":"f03f7b035106bba3da9b565be6f0115dc0d88f87@cloudbees.com","name":"Jesse Glick"},"message":"Removing MatrixChildAction dependency.\n(cherry picked from commit 42195d83c44da53303d27b0759346747e4ac0857)","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/1b47215e68e0126b2e4e845b5f8842771c75073c"},{"sha":"3ca23a111170ead21d61738130c518074bbb7390","author":{"email":"f03f7b035106bba3da9b565be6f0115dc0d88f87@cloudbees.com","name":"Jesse Glick"},"message":"Unclear status of MatrixConfiguration when enableFingerprintsInDependencyGraph mode selected.\n(cherry picked from commit b9d8f554c6407da14ac3af68e1fa0ceb9af333fb)","distinct":false,"url":"https://api.github.com/repos/jglick/jenkins/commits/3ca23a111170ead21d61738130c518074bbb7390"}]}