[SECURITY-1046]

Author: stephenc

src/main/java/org/jenkinsci/plugin/gitea/ForkPullRequestDiscoveryTrait.java

@@ -25,6 +25,7 @@
 
 import edu.umd.cs.findbugs.annotations.NonNull;
 import hudson.Extension;
+import hudson.Util;
 import hudson.util.ListBoxModel;
 import java.util.EnumSet;
 import java.util.List;
@@ -286,7 +287,7 @@ public TrustContributors() {
         @Override
         protected boolean checkTrusted(@NonNull GiteaSCMSourceRequest request, @NonNull PullRequestSCMHead head) {
             return !head.getOrigin().equals(SCMHeadOrigin.DEFAULT)
-                    && request.getCollaboratorNames().contains(head.getOriginOwner());
+                    && Util.fixNull(request.getCollaboratorNames()).contains(head.getOriginOwner());
         }
 
         /**

src/main/java/org/jenkinsci/plugin/gitea/GiteaSCMSource.java

@@ -462,6 +462,35 @@ protected List<Action> retrieveActions(@NonNull SCMHead head, SCMHeadEvent event
         return result;
     }
 
+    @NonNull
+    @Override
+    public SCMRevision getTrustedRevision(@NonNull SCMRevision revision, @NonNull TaskListener listener)
+            throws IOException, InterruptedException {
+        if (revision instanceof PullRequestSCMRevision) {
+            PullRequestSCMHead head = (PullRequestSCMHead) revision.getHead();
+            try (GiteaConnection c = gitea().open()) {
+                try (GiteaSCMSourceRequest request = new GiteaSCMSourceContext(null, SCMHeadObserver.none())
+                        .withTraits(getTraits())
+                        .newRequest(this, listener)) {
+                    request.setConnection(c);
+                    Set<String> names = new HashSet<>();
+                    for (GiteaUser u: c.fetchCollaborators(giteaRepository)) {
+                        names.add(u.getUsername());
+                    }
+                    request.setCollaboratorNames(names);
+                    if (request.isTrusted(head)) {
+                        return revision;
+                    }
+                }
+                PullRequestSCMRevision rev = (PullRequestSCMRevision) revision;
+                listener.getLogger().format("Loading trusted files from base branch %s at %s rather than %s%n",
+                        head.getTarget().getName(), ((SCMRevisionImpl)rev.getTarget()).getHash(), rev.getOrigin().getHash());
+                return rev.getTarget();
+            }
+        }
+        return revision;
+    }
+
     @NonNull
     @Override
     public SCM build(@NonNull SCMHead head, SCMRevision revision) {