Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for GroupAccessToken credentials, fix credential integration #479

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

mzellho
Copy link

@mzellho mzellho commented Mar 5, 2025

As a follow-up to #478, this PR adds another type of credentials for GroupAccessToken (which are not really any different to PersonalAccessToken or even project access tokens - it might be worth refactoring it towards a generic AccessToken) and fixes PersonalAccessToken and GroupAccessToken to be StandardUsernameCredentials, so they can also be used for the checkout.

@mzellho
Copy link
Author

mzellho commented Mar 5, 2025

Review highly appreciated!

*/
@Restricted(NoExternalUse.class) // stapler
@SuppressWarnings("unused")
public FormValidation doCheckToken(@QueryParameter String value) {

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing permission check Warning

Potential missing permission check in DescriptorImpl#doCheckToken
*/
@Restricted(NoExternalUse.class) // stapler
@SuppressWarnings("unused")
public FormValidation doCheckToken(@QueryParameter String value) {

Check warning

Code scanning / Jenkins Security Scan

Stapler: Missing POST/RequirePOST annotation Warning

Potential CSRF vulnerability: If DescriptorImpl#doCheckToken connects to user-specified URLs, modifies state, or is expensive to run, it should be annotated with @POST or @RequirePOST
@mzellho mzellho marked this pull request as ready for review March 5, 2025 14:40
@mzellho mzellho requested a review from jetersen as a code owner March 5, 2025 14:40
@mzellho mzellho marked this pull request as draft March 6, 2025 06:47
@mzellho mzellho marked this pull request as ready for review March 6, 2025 07:50
@mzellho mzellho changed the title Add support for GroupAccessToken credentials, fix unauthorized API calls Add support for GroupAccessToken credentials, fix credential integration Mar 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant