Skip to main content

Posts

Showing posts from July, 2022

Attacking Jenkins with Shared Libraries

What is Jenkins Shared Library ? Jenkins shared library is popular where large number of jenkins jobs or pipelines uses a repeated code in pipeline script. The developers creates certain modular functions containing the repetitive code and then reuses across various projects/pipelines/jobs. It is commonly seen in enterprise or organizations where teams work on multiple projects that shares common patterns in every pipelines. Imagine a function to send notifications to Slack about a build passed/failed can be used by many jobs. These shared functions are often kept in some SCM like github and may or maynot be publicly accessible. As they are helper functions and does not carry any customer data/code, the scm repository is usually not private sometimes.  What does the project structure of Jenkins Shared Library looks like? As copied from ( https://www.jenkins.io/doc/book/pipeline/shared-libraries/ ) (root) +- src # Groovy source files | +- org | +- foo |