tree 53165e0b5a2a4e1e187852fbaece0514a78a717b
parent 2f77407ce5f49a1a38722f3c2437cdcab2561413
author Luca Milanesio <luca.milanesio@gmail.com> 1790931665 +0100
committer Luca Milanesio <luca.milanesio@gmail.com> 1790951371 -0700

Disable validation of Jenkinsfile changes

The validation of arbitrary Jenkinsfile changes allows for Remote Code
Execution (RCE) on the Jenkins controller and agents. This may allow
unauthorised write access to untrusted build artifacts (e.g.,
/var/jenkins_home/jobs), disclosure of untrusted credentials (including
Git read-only credentials for fetching code for builds, BuildBuddy RBE
keys for accessing the build cache).

The RCE is, however, inherently linked with the concept of CI/CD because
the whole point of build validation is to fetch _potentially untrusted_
code from a contributor and running it on a server system.

All the credentials potentially exposed are untrusted and have no power
to submit or push any code to Gerrit. The sole purpose of the service
users running the build is to provide a `Verified` label, and they
cannot approve any incoming change automatically.

Bug: Issue 568458159
Change-Id: I2c1c6c16714d2297424ba15a4fa4ed021964d2e3