[JIRA] [core] (JENKINS-33304) LegacySecurityRealm does not handle "special" characters in usernames

[te...@java.net (JIRA)]

Title: Message Title

James Nord created an issue   Jenkins / JENKINS-33304 LegacySecurityRealm does not handle "special" characters in usernames Issue Type: Bug Assignee: Unassigned Components: core Created: 03/Mar/16 7:00 PM Priority: Minor Reporter: James Nord Depending on your environment Jenkins could be passed usernames such as EXAMPLE\joe if the underlying container is doing SSO in a windows domain. This causes several things not to work correctly. the link in the top right goes to a user that is not the logged in user (example_joe vs example\joe") my views does not work correctly - similar to above. Jenkins will store the users config.xml as ${JENKINS_HOME}\users\example\joe which seems like an accident waiting to happen. There are several other things where this is not quite right. Rather than trying to chase down everything that doesn't work the LegacySecurityRealm should sanitize the passed in username to make sure it is actually safe to use first. steps to reproduce. install tomcat 8 on a machine conencted to a windows domain. install Jenkins in the root of tomcat install waffle Waffle Download waffle 1.7 unpack waffle-distro-1.7.4-distro.zip to a temporary location copy the following files to ${TOMCAT_INSTALL_DIR}\lib guava-18.0.jar jna-4.2.1.jar jna-platform-4.2.1.jar slf4j-api-1.7.12.jar waffle-jna-1.7.5.jar waffle-tomcat8-1.7.5.jar Create ${TOMCAT_INSTALL_DIR}\conf\Catalina\localhost\ROOT.xml with the following content: <?xml version='1.0' encoding='utf-8'?> <Context> <Valve className="waffle.apache.NegotiateAuthenticator" principalFormat="fqn" roleFormat="both" /> <Realm className="waffle.apache.WindowsRealm" /> </Context> start Jenkins login to jenkins and try to create things like views etc Expected results it all works. Actual results you get a mix of things that work, don;t quite work, and just plain blow up in your face with 404 errors etc. Add Comment   This message was sent by Atlassian JIRA (v6.4.2#64017-sha1:e244265) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.