screwdriver-api 8.0.182 → 8.0.184

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "screwdriver-api",
-  "version": "8.0.182",
+  "version": "8.0.184",
   "description": "API server for the Screwdriver.cd service",
   "main": "index.js",
   "scripts": {

package/plugins/builds/artifacts/get.js

@@ -83,10 +83,18 @@ module.exports = config => ({
                             const directoryArray = manifestArray.filter(f => f.startsWith(`./${artifact}/`));
                             let totalSize = 0;
 
+                            // Manifest entries are build controlled, so encode them the same way
+                            // single file requests are encoded. Appending them verbatim lets
+                            // `..` segments be resolved away when the URL is normalized, which
+                            // would point the request at another build's artifacts.
+                            const fileUrl = file =>
+                                `${baseUrl}/${encodeURIComponent(file.replace(/^\.\//, ''))}`
+                                + `?token=${token}&type=download`;
+
                             // Check file sizes by fetching metadata
                             for (const file of directoryArray) {
                                 if (file) {
-                                    const fileMetaResponse = await request.head(`${baseUrl}/${file}?token=${token}&type=download`);
+                                    const fileMetaResponse = await request.head(fileUrl(file));
                                     const fileSize = parseInt(fileMetaResponse.headers['content-length'], 10);
 
                                     // Accumulate total size
@@ -120,7 +128,7 @@ module.exports = config => ({
                             // Fetch and append the directory files
                             for (const file of directoryArray) {
                                 if (file) {
-                                    const fileStream = request.stream(`${baseUrl}/${file}?token=${token}&type=download`);
+                                    const fileStream = request.stream(fileUrl(file));
 
                                     // Handle errors from file streaming
                                     fileStream.on('error', (err) => {

package/plugins/builds/artifacts/getAll.js

@@ -92,7 +92,12 @@ module.exports = config => ({
                     try {
                         for (const file of manifestArray) {
                             if (file) {
-                                const fileStream = request.stream(`${baseUrl}/${file}?token=${token}&type=download`);
+                                // Manifest entries are build controlled, so encode them before
+                                // appending. Verbatim entries let `..` segments be resolved away
+                                // when the URL is normalized, which would point the request at
+                                // another build's artifacts.
+                                const encodedFile = encodeURIComponent(file.replace(/^\.\//, ''));
+                                const fileStream = request.stream(`${baseUrl}/${encodedFile}?token=${token}&type=download`);
 
                                 fileStream.on('error', (err) => {
                                     logger.error(`Error downloading file: ${file}`, err);

package/plugins/coverage/README.md

@@ -27,7 +27,16 @@ server.register({
 ### Routes
 
 #### Returns an access token to talk to coverage server
-`GET /coverage/token?scope=job&projectKey=job:123&projectName=d2lam/mytest&username=user-job-123`
+`GET /coverage/token?projectKey=job:123`
+
+`scope`, `projectName`, and `username` are not accepted as query parameters — all three are always resolved
+server-side from the build's own JWT-verified identity. `projectKey` is rejected with a `403` unless it
+names a project the calling build is authorized for (its own pipeline, its own job, or its PR parent job)
+**and** matches the build's own resolved coverage scope.
+
+> **Deployment order:** requires `screwdriver-coverage-sonar` ≥6.0.0
+> ([coverage-sonar#80](https://github.com/screwdriver-cd/coverage-sonar/pull/80)). This API change must be
+> deployed *before* that dependency is bumped — see that PR's README for why.
 
 #### Get an object with coverage info
 

package/plugins/coverage/token.js

@@ -22,26 +22,20 @@ module.exports = config => ({
             const { jobFactory, pipelineFactory } = request.server.app;
             const buildCredentials = request.auth.credentials;
             const { jobId, pipelineId } = buildCredentials;
-            const { scope, projectKey, projectName, username, selfSonarHost, selfSonarAdminToken } = request.query;
+            const { projectKey, selfSonarHost, selfSonarAdminToken } = request.query;
+            // `scope`, `projectName`, and `username` are deliberately not read from the query. The coverage
+            // plugin derives all three from records resolved below via the build's own JWT-verified ids, so
+            // a build cannot override which Sonar project or scope its token/Git App binding applies to.
             const tokenConfig = {
-                buildCredentials,
-                scope
+                buildCredentials
             };
 
             if (projectKey) {
                 tokenConfig.projectKey = projectKey;
             }
 
-            if (projectName) {
-                tokenConfig.projectName = projectName;
-            }
-
-            if (username) {
-                tokenConfig.username = username;
-            }
-
-            // Get scope and job name
-            if (jobId && !scope) {
+            // Get scope and job name; always resolved here so neither can be supplied by the caller
+            if (jobId) {
                 const job = await jobFactory.get(jobId);
 
                 if (!job) {
@@ -49,6 +43,13 @@ module.exports = config => ({
                 }
 
                 tokenConfig.jobName = job.name;
+                // Invariant this rejection below relies on: screwdriver-cd/launcher's coverage/info call
+                // (launch.go, GetCoverageInfo) reads this exact field/index -
+                // job.Permutations[0].Annotations.CoverageScope - and always sends it as `scope`, empty
+                // string when absent, never omitted (screwdriver.go's CoverageURL has no projectKey param
+                // at all). So the scope screwdriver-coverage-sonar resolved when it minted
+                // SD_SONAR_PROJECT_KEY and the annotation re-read here cannot disagree for a real build,
+                // short of a pipeline sync rewriting this annotation between build start and this request.
                 tokenConfig.scope =
                     job.permutations[0] && job.permutations[0].annotations
                         ? job.permutations[0].annotations[COVERAGE_SCOPE_ANNOTATION]
@@ -56,8 +57,8 @@ module.exports = config => ({
             }
             let pipeline;
 
-            // Get pipeline name
-            if (pipelineId && (!projectName || projectName.includes('undefined'))) {
+            // Get pipeline name; always resolved here so it can never be supplied by the caller
+            if (pipelineId) {
                 pipeline = await pipelineFactory.get(pipelineId);
 
                 if (!pipeline) {
@@ -91,12 +92,6 @@ module.exports = config => ({
             const data = await config.coveragePlugin.getAccessToken(tokenConfig);
             const { projectUrl } = config.coveragePlugin.getProjectData(tokenConfig);
 
-            if (!pipeline && pipelineId) {
-                pipeline = await pipelineFactory.get(pipelineId);
-
-                logger.info(`looking up again, pipeline:${pipelineId}, and found pipeline: ${pipeline}`);
-            }
-
             if (pipeline && projectUrl) {
                 try {
                     const pipelineSonarBadge = {