jenkinsci / fortify-plugin

Fortify Jenkins plugin
https://plugins.jenkins.io/fortify
Other
23 stars 29 forks source link

RemoteService::locateFPRInWorkspace fails when recursive symlinks are present #62

Closed Fxhnd closed 1 year ago

Fxhnd commented 1 year ago

Jenkins and plugins versions report

Fortify Plugin v21.1.36, but applies up-to and including master as well

What Operating System are you using (both controller, and any agents involved in the problem)?

Redhat Enterprise Linux 7.9 on both controller and agents

Reproduction steps

  1. Create a repository or Jenkins workspace which contains a recursive symlink (e.g. a symlink to itself).
  2. Run a build as normal to produce artifacts for Fortify to Scan
  3. Run steps.fortifyUpload (optionally provide resultsFile, it doesn't matter)
  4. Wait for timeout to occur because of recursive directory search

Expected Results

The file search in https://github.com/jenkinsci/fortify-plugin/blob/master/src/main/java/com/fortify/plugin/jenkins/RemoteService.java#L77 should search all available files for the FPR file and return accordingly.

Actual Results

Jenkins raises a FileSystemLoopException and fortifyUpload exits uncleanly.

Anything else?

Suggestion to prevent the search from traversing down recursive paths is to keep support for projects which utilize the recursive directory structure. Some packaging tools such as CPack have quirks where you need to artificially inflate the filepath to the source and build folders -- using an in-directory symlink (created by the pipeline) is a straightforward way to accomplish this.