control not used of git protocol with credentials in FIPS mode

Signed-off-by: Olivier Lamy <[email protected]>
jenkinsci · Jul 29, 2024 · 08a38cf · 08a38cf
1 parent f9668af
commit 08a38cf
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/src/main/java/jenkins/plugins/git/GitSCMSource.java b/src/main/java/jenkins/plugins/git/GitSCMSource.java
@@ -416,7 +416,7 @@ public List<SCMSourceTrait> getTraits() {
      * @return will return {@code false} if using any credentials with a non TLS protocol with FIPS mode activated @see {@link FIPS140#useCompliantAlgorithms()}
      */
     public static boolean isFIPSLtsCompliant(String credentialsId, String remoteUrl) {
-        return !FIPS140.useCompliantAlgorithms() || !StringUtils.isNotEmpty(credentialsId) || !StringUtils.startsWith(remoteUrl, "http:");
+        return !FIPS140.useCompliantAlgorithms() || !StringUtils.isNotEmpty(credentialsId) || (!StringUtils.startsWith(remoteUrl, "http:") && !StringUtils.startsWith(remoteUrl, "git:"));
     }
 
     @Symbol("git")

diff --git a/src/test/java/hudson/plugins/git/FIPSModeUrlCheckTest.java b/src/test/java/hudson/plugins/git/FIPSModeUrlCheckTest.java
@@ -59,6 +59,8 @@ public void testFIPSLtsMethod() {
         assertThat(GitSCMSource.isFIPSLtsCompliant("beer", "https://github.com/cheese/wine"), is(true));
         assertThat(GitSCMSource.isFIPSLtsCompliant(null, "[email protected]:cheese/wine.git"), is(true));
         assertThat(GitSCMSource.isFIPSLtsCompliant("beer", "[email protected]:cheese/wine.git"), is(true));
+        assertThat(GitSCMSource.isFIPSLtsCompliant(null, "git://github.com/cheese/wine"), is(true));
+        assertThat(GitSCMSource.isFIPSLtsCompliant("beer", "git://github.com/cheese/wine"), is(false));
     }
 
     @Test