Jenkins/In-process Script Approval - Revision history

Pio2pio: /* Approve scripts */

2020-03-28T15:41:47Z

Approve scripts

@@ Line 5: / Line 5: @@
 = Approve scripts =
 In order to get past this Jenkins security feature, you will need to approve your script. Go to Manage Jenkins -> In-process Script Approval. In that screen, you will see the script that you are trying to execute. There should be an approve button that you'll need to click to approve that script.
 = Disable globally =

Pio2pio: /* Approve scripts */

2020-03-28T15:24:39Z

Approve scripts

← Older revision		Revision as of 17:24, 28 March 2020
Line 1:		Line 1:
			Documentation of [https://jenkins.io/doc/book/managing/script-approval/ script-approval] contains all details about:
			* Script Security plugin (this is what we discussed here in this post)
			* Groovy sandbox
			* script approval
	= Approve scripts =		= Approve scripts =
	In order to get past this Jenkins security feature, you will need to approve your script. Go to Manage Jenkins -> In-process Script Approval. In that screen, you will see the script that you are trying to execute. There should be an approve button that you'll need to click to approve that script.		In order to get past this Jenkins security feature, you will need to approve your script. Go to Manage Jenkins -> In-process Script Approval. In that screen, you will see the script that you are trying to execute. There should be an approve button that you'll need to click to approve that script.


	= Disable globally =		= Disable globally =

Pio2pio: /* Resources */

2020-03-28T15:21:34Z

Resources

← Older revision		Revision as of 17:21, 28 March 2020
Line 74:		Line 74:
	= Resources =		= Resources =
	* [http://job-dsl.herokuapp.com/ Jenkins Job DSL Playground]		* [http://job-dsl.herokuapp.com/ Jenkins Job DSL Playground]
			* [https://github.com/cloudbees/jenkins-scripts/blob/master/pipeline-approval-scripts.groovy pipeline-approval-scripts.groovy] https://github.com/cloudbees/jenkins-scripts

Pio2pio at 14:57, 28 March 2020

2020-03-28T14:57:15Z

@@ Line 1: / Line 1: @@
-Script Sec
+= Approve scripts =
 The caveat, it will not prompt for approval any first layer DSL Script inline or from a file, but still will call for approval if nested scripts validate Security Script rules. Eg. Jenkins DSL Plugin will process without approval the DSL code (layer1) but if there is a  pipeline{} code that is considered as another script inline or from a file (layer2) it will need to be approved.
@@ Line 53: / Line 57: @@
+}
 </source>

Pio2pio: Created page with "Script Sec = Disable = In order to get past this Jenkins security feature, you will need to approve your script. Go to Manage Jenkins -> In-process Script Approval. In that..."

2020-03-28T14:46:49Z

Created page with "Script Sec = Disable = In order to get past this Jenkins security feature, you will need to approve your script. Go to Manage Jenkins -> In-process Script Approval. In that..."

New page

Script Sec

= Disable =
In order to get past this Jenkins security feature, you will need to approve your script. Go to Manage Jenkins -> In-process Script Approval. In that screen, you will see the script that you are trying to execute. There should be an approve button that you'll need to click to approve that script.

The caveat, it will not prompt for approval any first layer DSL Script inline or from a file, but still will call for approval if nested scripts validate Security Script rules. Eg. Jenkins DSL Plugin will process without approval the DSL code (layer1) but if there is a pipeline{} code that is considered as another script inline or from a file (layer2) it will need to be approved.

2-layer DSL script. It contains <code>Utils.markStageSkippedForConditional</code> that uses not whitelisted method.
<source lang=groovy>
pipelineJob('New_pipeline') { // <- layer1 script will get executed
parameters {
choiceParam( 'ACTION', ["plan","apply"],"terraform plan or apply")
}
definition {
cps {
script(''' // <- layer2, will require approval
import org.jenkinsci.plugins.pipeline.modeldefinition.Utils
def hosts
pipeline {
agent any
environment {
REGION = "eu-west-1"
}
stages {
stage('Build host lists') {
steps {
script {
hosts = [ "node-1", "node-2" ]
}
}
}
stage('Display list') {
steps {
echo 'Print host[0]'
sh \'\'\'#!/bin/bash
HOST=\'\'\' + hosts[0] + \'\'\'
printf "HOST: $HOST";
\'\'\'
}
stage('SkipStage') {
steps {
// requires approval
Utils.markStageSkippedForConditional('SkipStage')
}
}
}
}
}
''')
}
}
}
</source>