Package com.atlassian.bamboo.security.validation

Class RepositoryVariableSecurityValidatorImpl

java.lang.Object

com.atlassian.bamboo.security.validation.RepositoryVariableSecurityValidatorImpl

All Implemented Interfaces:

RepositoryVariableSecurityValidator

@Component
public class RepositoryVariableSecurityValidatorImpl
extends Object
implements RepositoryVariableSecurityValidator

Validates repository-sourced variable values for shell injection risks.

The first character must be alphanumeric or underscore. Leading dashes are blocked to prevent CLI flag injection; leading dots are blocked to avoid hidden-file path confusion. Subsequent characters may also include dash, forward slash, and dot. All other characters (shell metacharacters, spaces, quotes, etc.) are rejected.

Constructor Summary

Constructors

Constructor	Description
RepositoryVariableSecurityValidatorImpl(AdministrationConfigurationAccessor administrationConfigurationAccessor, RepositoryVariableSecurityViolationPublisher violationPublisher)

Method Summary

Modifier and Type	Method	Description
@NotNull SecurityValidationResult	validateBranchName(@NotNull String branchName, @NotNull PartialVcsRepositoryData repositoryData, @Nullable ImmutableChain plan)	Validates a branch name received from a VCS repository.
@NotNull SecurityValidationResult	validateBranchNameForUI(@Nullable String branchName)	Validates a branch name received from a VCS repository.
@NotNull SecurityValidationResult	validatePullRequestMetadata(@Nullable String sourceBranch, @Nullable String targetBranch, @Nullable String prKey, @Nullable VcsRepositoryData sourceRepositoryData, @Nullable VcsRepositoryData targetRepositoryData)	Validates the branch names and key associated with a pull request.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

RepositoryVariableSecurityValidatorImpl

public RepositoryVariableSecurityValidatorImpl(AdministrationConfigurationAccessor administrationConfigurationAccessor,
 RepositoryVariableSecurityViolationPublisher violationPublisher)

Method Details

validateBranchName

@NotNull
public @NotNull SecurityValidationResult validateBranchName(@NotNull
 @NotNull String branchName,
 @NotNull
 @NotNull PartialVcsRepositoryData repositoryData,
 @Nullable
 @Nullable ImmutableChain plan)

Description copied from interface: RepositoryVariableSecurityValidator

Validates a branch name received from a VCS repository.

Specified by:

validateBranchName in interface RepositoryVariableSecurityValidator

Parameters:

branchName - the branch name to validate; null or empty is allowed

Returns:

allowed result if the name is safe, blocked result otherwise

validateBranchNameForUI

@NotNull
public @NotNull SecurityValidationResult validateBranchNameForUI(@Nullable
 @Nullable String branchName)

Description copied from interface: RepositoryVariableSecurityValidator

Validates a branch name received from a VCS repository.

Specified by:

validateBranchNameForUI in interface RepositoryVariableSecurityValidator

Parameters:

branchName - the branch name to validate; null or empty is allowed

Returns:

allowed result if the name is safe, blocked result otherwise Doesn't emit the security violation notification

validatePullRequestMetadata

@NotNull
public @NotNull SecurityValidationResult validatePullRequestMetadata(@Nullable
 @Nullable String sourceBranch,
 @Nullable
 @Nullable String targetBranch,
 @Nullable
 @Nullable String prKey,
 @Nullable
 @Nullable VcsRepositoryData sourceRepositoryData,
 @Nullable
 @Nullable VcsRepositoryData targetRepositoryData)

Description copied from interface: RepositoryVariableSecurityValidator

Validates the branch names and key associated with a pull request.

Specified by:

validatePullRequestMetadata in interface RepositoryVariableSecurityValidator

Parameters:

sourceBranch - PR source branch; null or empty is allowed

targetBranch - PR target branch; null or empty is allowed

prKey - PR key/identifier; null or empty is allowed

sourceRepositoryData - source repository metadata for security auditing/logging context; may be null

targetRepositoryData - target repository metadata for security auditing/logging context; may be null

Returns:

allowed result if all fields are safe, blocked result otherwise