From 41db33cda36ea4ef70e8c20655d241c3659b12de Mon Sep 17 00:00:00 2001
From: James Nord <jtnord@users.noreply.github.com>
Date: Mon, 22 Jul 2024 00:41:04 +0100
Subject: [PATCH 1/3] [JENKINS-73404] SecretTextArea missing FormValidation
 support (#9450)

* [JENKINS-73404] unit test

* roundtrip as Secrets

* [JENKINS-73404] add validation for SecretTextArea

reworked the jelly and simplified the javascript.

the textarea is now always present in the DOM, so no need to remove
inputs to add a textarea.  Rather we just remove /hide the "hidden" attribute
from the elements we want to show/hide and give the textArea the
expected class and attributes for validation to occur

* remove unused data-prompt attribute

* Adapt getHiddenSecretValue to backend changes

* Adapt to Secrets being sent as "" rather than null

values for SecretTextArea are now always sent.  Whilst this is a change
in behavior the only way once set to unset is to set the value to the
mpty string "" which would still produce a Secret

Additionally this matches the behaviour of f:password and f:textarea

Given both of the above this change in behaviour should not break any
production use cases.

* Remove trailing spaces

---------

Co-authored-by: Mark Waite <mark.earl.waite@gmail.com>
(cherry picked from commit 81b90e4c118bcdc9b283037e819fb2d6217da18a)
---
 .../resources/lib/form/secretTextarea.jelly   |  28 +++-
 .../lib/form/secretTextarea/secret.css        |   6 +-
 .../lib/form/secretTextarea/secret.js         |  35 ++---
 .../hudson/util/FormFieldValidatorTest.java   | 125 +++++++++++++++++-
 .../java/lib/form/SecretTextareaTest.java     |  15 ++-
 .../ValidatingDescribable/config.jelly        |  20 +++
 6 files changed, 195 insertions(+), 34 deletions(-)
 create mode 100644 test/src/test/resources/hudson/util/FormFieldValidatorTest/ValidatingDescribable/config.jelly

diff --git a/core/src/main/resources/lib/form/secretTextarea.jelly b/core/src/main/resources/lib/form/secretTextarea.jelly
index ca95219fc3f3..323a8435d0f3 100644
--- a/core/src/main/resources/lib/form/secretTextarea.jelly
+++ b/core/src/main/resources/lib/form/secretTextarea.jelly
@@ -2,7 +2,7 @@
 <!--
   ~ The MIT License
   ~
-  ~ Copyright (c) 2019 CloudBees, Inc.
+  ~ Copyright (c) 2019-2024 CloudBees, Inc.
   ~
   ~ Permission is hereby granted, free of charge, to any person obtaining a copy
   ~ of this software and associated documentation files (the "Software"), to deal
@@ -56,9 +56,24 @@ Example usage:
         <st:attribute name="placeholder">
             Placeholder text for input field when displayed.
         </st:attribute>
+        <st:attribute name="checkUrl">
+            If specified, the value entered in this input field will be checked (via AJAX)
+            against this URL, and errors will be rendered under the text field.
+
+            If @field is specified, this will be inferred automatically,
+            which is the recommended approach.
+        </st:attribute>
+        <st:attribute name="checkMethod" use="optional" type="String">
+            Specify 'get' (must be lowercase) to change the HTTP method used for the AJAX requests to @checkUrl from a POST to a GET.
+            If any other value is specified then requests will use POST.
+            The historical default was GET and 'post' had to be specified to change that, but this was changed in Jenkins 2.285.
+        </st:attribute>
+
     </st:documentation>
 
     <f:prepareDatabinding/>
+    <j:set var="id" value="secretTextAreadId-${h.generateId()}" />
+
     <j:set var="name" value="${attrs.name ?: '_.'+attrs.field}"/>
     <j:set var="value" value="${h.getPasswordValue(attrs.value ?: instance[attrs.field])}"/>
     <j:set var="addText" value="${%Add}"/>
@@ -66,7 +81,7 @@ Example usage:
     <j:set var="buttonText" value="${value == null ? addText : replaceText}"/>
 
     <st:adjunct includes="lib.form.secretTextarea.secret"/>
-    <div class="secret" data-name="${name}" data-placeholder="${attrs.placeholder ?: ''}" data-prompt="${%EnterSecret}">
+    <div class="secret">
         <div class="secret-header">
             <div class="secret-legend">
                 <j:choose>
@@ -76,14 +91,21 @@ Example usage:
                     <j:otherwise>
                         <l:icon src="symbol-lock-closed" class="icon-md"/>
                         <span>${%Concealed}</span>
-                        <input type="hidden" name="${name}" value="${value}"/>
                     </j:otherwise>
                 </j:choose>
             </div>
             <div class="secret-update">
                 <button type="button" class="secret-update-btn jenkins-button jenkins-button--primary">${buttonText}</button>
+                <label hidden="hidden" for="${id}">${%EnterSecret}</label>
             </div>
         </div>
+        <div class="secret-input">
+            <textarea id="${id}" hidden="hidden" name="${name}" placeholder="${placeholder}"
+                      class="${attrs.checkUrl!=null?' jenkins-input validated':''}"
+                      checkUrl="${attrs.checkUrl}" checkDependsOn="${attrs.checkDependsOn}" checkMethod="${attrs.checkMethod}">
+                <st:out value="${value}" />
+            </textarea>
+        </div>
     </div>
 
 </j:jelly>
diff --git a/core/src/main/resources/lib/form/secretTextarea/secret.css b/core/src/main/resources/lib/form/secretTextarea/secret.css
index 39d98e0bfcf7..eb74f5d004b0 100644
--- a/core/src/main/resources/lib/form/secretTextarea/secret.css
+++ b/core/src/main/resources/lib/form/secretTextarea/secret.css
@@ -1,7 +1,7 @@
 /*
  * The MIT License
  *
- * Copyright (c) 2019 CloudBees, Inc.
+ * Copyright (c) 2019-2024 CloudBees, Inc.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -65,3 +65,7 @@
   border: none;
   padding: 1em;
 }
+
+.secret * [hidden] {
+  display: none !important;
+}
diff --git a/core/src/main/resources/lib/form/secretTextarea/secret.js b/core/src/main/resources/lib/form/secretTextarea/secret.js
index 3bc32394f81e..298ee043af9d 100644
--- a/core/src/main/resources/lib/form/secretTextarea/secret.js
+++ b/core/src/main/resources/lib/form/secretTextarea/secret.js
@@ -28,36 +28,21 @@ Behaviour.specify(".secret", "secret-button", 0, function (e) {
     return;
   }
 
-  var id = "secret-" + iota++;
-  var name = e.getAttribute("data-name");
-  var placeholder = e.getAttribute("data-placeholder");
-  var prompt = e.getAttribute("data-prompt");
-
-  var appendSecretInput = function () {
-    var textarea = document.createElement("textarea");
-    textarea.setAttribute("id", id);
-    textarea.setAttribute("name", name);
-    if (placeholder !== null && placeholder !== "") {
-      textarea.setAttribute("placeholder", placeholder);
-    }
-    var secretInput = document.createElement("div");
-    secretInput.setAttribute("class", "secret-input");
-    secretInput.appendChild(textarea);
-    e.appendChild(secretInput);
+  var unhideSecretInput = function () {
+    var textArea = e.querySelector('textarea[hidden="hidden"]');
+    textArea.removeAttribute("hidden");
   };
 
   var clearSecretValue = function () {
-    var secretValue = e.querySelector('input[type="hidden"]');
-    if (secretValue !== null) {
-      secretValue.parentNode.removeChild(secretValue);
-    }
+    var secretValue = e.querySelector("textarea");
+    secretValue.value = "";
   };
 
   var replaceUpdateButton = function () {
-    var secretLabel = document.createElement("label");
-    secretLabel.setAttribute("for", id);
-    secretLabel.appendChild(document.createTextNode(prompt));
-    secretUpdateBtn.parentNode.replaceChild(secretLabel, secretUpdateBtn);
+    secretUpdateBtn.setAttribute("hidden", "hidden");
+    // unhide the span text
+    var prompt = e.querySelector('label[hidden="hidden"]');
+    prompt.removeAttribute("hidden");
   };
 
   var removeSecretLegendLabel = function () {
@@ -69,7 +54,7 @@ Behaviour.specify(".secret", "secret-button", 0, function (e) {
   };
 
   secretUpdateBtn.onclick = function () {
-    appendSecretInput();
+    unhideSecretInput();
     clearSecretValue();
     replaceUpdateButton();
     removeSecretLegendLabel();
diff --git a/test/src/test/java/hudson/util/FormFieldValidatorTest.java b/test/src/test/java/hudson/util/FormFieldValidatorTest.java
index bdbb76946288..6e1b52c45c58 100644
--- a/test/src/test/java/hudson/util/FormFieldValidatorTest.java
+++ b/test/src/test/java/hudson/util/FormFieldValidatorTest.java
@@ -25,13 +25,19 @@
 package hudson.util;
 
 
+import static org.hamcrest.CoreMatchers.allOf;
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.hamcrest.MatcherAssert.assertThat;
+
 import hudson.model.AbstractProject;
 import hudson.model.FreeStyleProject;
 import hudson.tasks.BuildStepDescriptor;
 import hudson.tasks.BuildStepMonitor;
 import hudson.tasks.Builder;
 import hudson.tasks.Publisher;
+import hudson.tasks.Recorder;
 import java.io.IOException;
+import java.util.concurrent.atomic.AtomicInteger;
 import org.htmlunit.ScriptResult;
 import org.htmlunit.WebResponseListener;
 import org.htmlunit.html.HtmlPage;
@@ -42,6 +48,7 @@
 import org.jvnet.hudson.test.JenkinsRule;
 import org.jvnet.hudson.test.TestExtension;
 import org.kohsuke.stapler.DataBoundConstructor;
+import org.kohsuke.stapler.DataBoundSetter;
 import org.kohsuke.stapler.QueryParameter;
 import org.xml.sax.SAXException;
 
@@ -134,7 +141,7 @@ public boolean isApplicable(Class<? extends AbstractProject> jobType) {
     @Issue("JENKINS-3382")
     public void negative() throws Exception {
         BrokenFormValidatorBuilder.DescriptorImpl d = new BrokenFormValidatorBuilder.DescriptorImpl();
-        Publisher.all().add(d);
+        Recorder.all().add(d);
         try {
             FreeStyleProject p = j.createFreeStyleProject();
             p.getPublishersList().add(new BrokenFormValidatorBuilder());
@@ -152,4 +159,120 @@ public void negative() throws Exception {
             Publisher.all().remove(d);
         }
     }
+
+    @Issue("JENKINS-73404")
+    @Test
+    public void testValidationforComponents() throws Exception {
+        FreeStyleProject p = j.createFreeStyleProject();
+        p.getBuildersList().add(new ValidatingDescribable());
+        try (JenkinsRule.WebClient wc = j.createWebClient()) {
+            HtmlPage page = wc.getPage(p, "configure");
+            assertThat(page.asNormalizedText(), allOf(
+                    containsString("FormValidation: Password (empty)"),
+                    containsString("FormValidation: Password (populated)"),
+                    containsString("FormValidation: Textarea"),
+                    containsString("FormValidation: SecretTextarea (empty)"),
+                    containsString("FormValidation: SecretTextarea (populated)")));
+
+        }
+
+    }
+
+    public static class ValidatingDescribable extends Builder {
+
+        private Secret emptyPassword;
+        // give the secret some data so that it is hidden and not a regular field!
+        private Secret populatedPassword = Secret.fromString("secret!");
+        private String textarea;
+        private Secret emptySecretTextarea;
+        private Secret populatedSecretTextarea = Secret.fromString("sensitive!");;
+
+        @DataBoundConstructor
+        public ValidatingDescribable() {
+        }
+
+        public Secret getEmptyPassword() {
+            return emptyPassword;
+        }
+
+        @DataBoundSetter
+        public void setEmptyPassword(Secret emptyPassword) {
+            this.emptyPassword = emptyPassword;
+        }
+
+        public Secret getPopulatedPassword() {
+            return populatedPassword;
+        }
+
+        @DataBoundSetter
+        public void setPopulatedPassword(Secret populatedPassword) {
+            this.populatedPassword = populatedPassword;
+        }
+
+        public String getTextarea() {
+            return textarea;
+        }
+
+        @DataBoundSetter
+        public void setTextarea(String textarea) {
+            this.textarea = textarea;
+        }
+
+        public Secret getEmptySecretTextarea() {
+            return emptySecretTextarea;
+        }
+
+        @DataBoundSetter
+        public void setEmptySecretTextarea(Secret emptySecretTextarea) {
+            this.emptySecretTextarea = emptySecretTextarea;
+        }
+
+        public Secret getPopulatedSecretTextarea() {
+            return populatedSecretTextarea;
+        }
+
+        @DataBoundSetter
+        public void setPopulatedSecretTextarea(Secret populatedSecretTextarea) {
+            this.populatedSecretTextarea = populatedSecretTextarea;
+        }
+
+        @TestExtension
+        public static class DescriptorImpl extends BuildStepDescriptor<Builder> {
+            // not used for the test class but useful for interactive debugging to check the validation has been called
+            AtomicInteger i = new AtomicInteger();
+
+            @Override
+            public String getDisplayName() {
+                return "Validation Testing";
+            }
+
+            public FormValidation doCheckEmptyPassword(@QueryParameter String value) {
+                return FormValidation.ok("FormValidation: Password (empty)" + i.getAndIncrement());
+            }
+
+            public FormValidation doCheckPopulatedPassword(@QueryParameter String value) {
+                return FormValidation.ok("FormValidation: Password (populated)" + i.getAndIncrement());
+            }
+
+            public FormValidation doCheckTextarea(@QueryParameter String value) {
+                return FormValidation.ok("FormValidation: Textarea" + i.getAndIncrement());
+            }
+
+            public FormValidation doCheckEmptySecretTextarea(@QueryParameter String value) {
+                return FormValidation.ok("FormValidation: SecretTextarea (empty)" + i.getAndIncrement());
+            }
+
+            public FormValidation doCheckPopulatedSecretTextarea(@QueryParameter String value) {
+                return FormValidation.ok("FormValidation: SecretTextarea (populated)" + i.getAndIncrement());
+            }
+
+            @Override
+            public boolean isApplicable(Class jobType) {
+                return true;
+            }
+
+        }
+
+    }
+
 }
diff --git a/test/src/test/java/lib/form/SecretTextareaTest.java b/test/src/test/java/lib/form/SecretTextareaTest.java
index a0d68fbe1132..5ecfeae1f8da 100644
--- a/test/src/test/java/lib/form/SecretTextareaTest.java
+++ b/test/src/test/java/lib/form/SecretTextareaTest.java
@@ -37,7 +37,7 @@
 import java.io.IOException;
 import org.htmlunit.html.HtmlElement;
 import org.htmlunit.html.HtmlForm;
-import org.htmlunit.html.HtmlHiddenInput;
+import org.htmlunit.html.HtmlTextArea;
 import org.htmlunit.html.HtmlTextInput;
 import org.junit.Before;
 import org.junit.Rule;
@@ -120,8 +120,8 @@ private static void clickSecretUpdateButton(HtmlForm configForm) throws IOExcept
     }
 
     private static String getHiddenSecretValue(HtmlForm configForm) {
-        HtmlHiddenInput hiddenSecret = configForm.getInputByName("_.secret");
-        return hiddenSecret == null ? null : hiddenSecret.getValue();
+        HtmlTextArea hiddenSecret = configForm.getTextAreaByName("_.secret");
+        return hiddenSecret == null ? null : hiddenSecret.getTextContent();
     }
 
     public static class TestBuilder extends Builder {
@@ -144,7 +144,7 @@ private static TestBuilder fromStringWithDescription(String secret, String descr
 
         @DataBoundConstructor
         public TestBuilder(Secret secret) {
-            this.secret = secret;
+            this.secret = fixEmptySecret(secret);
         }
 
         public Secret getSecret() {
@@ -160,6 +160,13 @@ public void setDescription(String description) {
             this.description = description;
         }
 
+        private static Secret fixEmptySecret(Secret possiblyEmpty) {
+            if (possiblyEmpty == null || possiblyEmpty.getPlainText().isEmpty()) {
+                return null;
+            }
+            return possiblyEmpty;
+        }
+
         @TestExtension
         public static class DescriptorImpl extends BuildStepDescriptor<Builder> {
             @NonNull
diff --git a/test/src/test/resources/hudson/util/FormFieldValidatorTest/ValidatingDescribable/config.jelly b/test/src/test/resources/hudson/util/FormFieldValidatorTest/ValidatingDescribable/config.jelly
new file mode 100644
index 000000000000..c560072d1ed4
--- /dev/null
+++ b/test/src/test/resources/hudson/util/FormFieldValidatorTest/ValidatingDescribable/config.jelly
@@ -0,0 +1,20 @@
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:st="jelly:stapler" xmlns:d="jelly:define" xmlns:l="/lib/layout" xmlns:t="/lib/hudson" xmlns:f="/lib/form">
+
+  <f:entry title="Password (empty)" field="emptyPassword">
+    <f:password/>
+  </f:entry>
+  <f:entry title="Password (populated)" field="populatedPassword">
+    <f:password/>
+  </f:entry>
+  <f:entry title="Textarea" field="textarea">
+    <f:textarea/>
+  </f:entry>
+  <f:entry title="Secret Textarea (empty)" field="emptySecretTextarea">
+    <f:secretTextarea/>
+  </f:entry>
+  <f:entry title="Secret Textarea (populated)" field="populatedSecretTextarea">
+    <f:secretTextarea/>
+  </f:entry>
+
+</j:jelly>

From 97883c30261069299d9db065a195fa1ac747daec Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 14 Aug 2024 19:33:33 -0700
Subject: [PATCH 2/3] Update dependency
 org.springframework:spring-framework-bom to v5.3.39 (#9612)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
(cherry picked from commit c5c69abd2d346a694c29b3e5f5d3991d94c38556)
---
 bom/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bom/pom.xml b/bom/pom.xml
index 9b0bbd9add9c..a10f107d6ccc 100644
--- a/bom/pom.xml
+++ b/bom/pom.xml
@@ -56,7 +56,7 @@ THE SOFTWARE.
       <dependency>
         <groupId>org.springframework</groupId>
         <artifactId>spring-framework-bom</artifactId>
-        <version>5.3.37</version>
+        <version>5.3.39</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>

From 85b9afec6c228698a2ab9eeecf3a538442f44ae7 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 19 Aug 2024 17:20:38 -0700
Subject: [PATCH 3/3] Update dependency org.jenkins-ci.plugins:junit to v1291
 (#9635)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
(cherry picked from commit aa348fc9d03ee2ed9cfcec70836a6e66379da5fa)
---
 test/pom.xml | 2 +-
 war/pom.xml  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/test/pom.xml b/test/pom.xml
index 7892d7aef50c..c56282483028 100644
--- a/test/pom.xml
+++ b/test/pom.xml
@@ -228,7 +228,7 @@ THE SOFTWARE.
     <dependency>
       <groupId>org.jenkins-ci.plugins</groupId>
       <artifactId>junit</artifactId>
-      <version>1265.v65b_14fa_f12f0</version>
+      <version>1291.v60776881903c</version>
       <scope>test</scope>
     </dependency>
     <dependency>
diff --git a/war/pom.xml b/war/pom.xml
index 05a325594d79..c135d10898e6 100644
--- a/war/pom.xml
+++ b/war/pom.xml
@@ -253,7 +253,7 @@ THE SOFTWARE.
                   <!-- detached after 1.577 -->
                   <groupId>org.jenkins-ci.plugins</groupId>
                   <artifactId>junit</artifactId>
-                  <version>1265.v65b_14fa_f12f0</version>
+                  <version>1291.v60776881903c</version>
                   <type>hpi</type>
                 </artifactItem>
                 <artifactItem>