New Injected Test: Require a Stapler verb annotation on web method looking methods

pom.xml

@@ -165,6 +165,11 @@ THE SOFTWARE.
       <version>1.0.2</version>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>io.github.classgraph</groupId>
+      <artifactId>classgraph</artifactId>
+      <version>4.4.7</version>
+    </dependency>
   </dependencies>
 
   <build>

src/main/java/org/jvnet/hudson/test/PluginAutomaticTestBuilder.java

@@ -26,12 +26,31 @@
 import hudson.PluginManager.FailedPlugin;
 import hudson.PluginWrapper;
 import hudson.cli.CLICommand;
-import java.io.File;
-import java.util.Map;
+import io.github.classgraph.ClassGraph;
+import io.github.classgraph.ClassInfo;
+import io.github.classgraph.ScanResult;
 import jenkins.model.Jenkins;
 import junit.framework.TestCase;
 import junit.framework.TestSuite;
 import org.apache.commons.lang3.StringUtils;
+import org.junit.Assert;
+import org.kohsuke.stapler.WebMethod;
+import org.kohsuke.stapler.interceptor.InterceptorAnnotation;
+import org.kohsuke.stapler.interceptor.RequirePOST;
+import org.kohsuke.stapler.verb.HttpVerbInterceptor;
+
+import java.io.File;
+import java.lang.annotation.Annotation;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.lang.reflect.Modifier;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.logging.Logger;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.Matchers.empty;
 
 /**
  * Called by the code generated by maven-hpi-plugin to build tests for plugins.
@@ -65,6 +84,7 @@ public static TestSuite build(Map<String,?> params) throws Exception {
             String packaging = StringUtils.defaultIfBlank((String)params.get("packaging"), "hpi");
             if ("hpi".equals(packaging)) {
                 inJenkins.addTest(new OtherTests("testPluginActive", params));
+                inJenkins.addTest(new OtherTests("testStaplerDispatches", params));
             }
             master.addTest(inJenkins);
             master.addTest(new PropertiesTestSuite(outputDirectory));
@@ -106,5 +126,88 @@ public void testPluginActive() {
             }
         }
 
+        public void testStaplerDispatches() throws InvocationTargetException, IllegalAccessException, NoSuchMethodException {
+            List<String> methodsFound = new ArrayList<>();
+
+            Method isStaplerRoutableMethod = findIsRoutableMethod();
+            if (isStaplerRoutableMethod == null) {
+                return;
+            }
+
+            PluginWrapper thisPlugin = determineCurrentPlugin();
+            if (thisPlugin == null) {
+                return; // we're not in a plugin
+            }
+            ClassGraph classGraph = new ClassGraph();
+            classGraph.addClassLoader(thisPlugin.classLoader);
+            classGraph.disableJarScanning();
+            classGraph.enableClassInfo();
+            ScanResult result = classGraph.scan();
+
+            for (ClassInfo classInfo : result.getAllClasses()) {
+                Class clazz = classInfo.loadClass();
+                for (Method m : clazz.getDeclaredMethods()) {
+                    if (isStaplerDispatchable(m) && (boolean)isStaplerRoutableMethod.invoke(null, m)) {
+                        if (!hasStaplerVerbAnnotation(m)) {
+                            methodsFound.add(clazz.getName() + "#" + m.getName());
+                        }
+                    }
+                }
+            }
+            Assert.assertThat("There should be no web methods that lack HTTP verb annotations like @RequirePOST, @GET, @POST, etc. -- see https://jenkins.io/redirect/developer/csrf-protection", methodsFound, is(empty()));
+        }
+
+        private Method findIsRoutableMethod() throws NoSuchMethodException {
+            try {
+                Method method = Class.forName("jenkins.security.stapler.TypedFilter").getDeclaredMethod("isRoutableMethod", Method.class);
+                method.setAccessible(true);
+                return method;
+            } catch (ClassNotFoundException e) {
+                LOGGER.warning("This test requires Jenkins 2.154, Jenkins LTS 2.138.4, or newer to run, use e.g. -Djenkins.version=2.138.4");
+                // TODO add a fallback implementing similar code directly here
+                return null;
+            }
+        }
+
+        private PluginWrapper determineCurrentPlugin() {
+            String plugin = (String) params.get("artifactId");
+            if (plugin != null) {
+                return Jenkins.getActiveInstance().pluginManager.getPlugin(plugin);
+            }
+            return null;
+        }
+
+        private boolean hasStaplerVerbAnnotation(Method m) {
+            if (m.getAnnotation(RequirePOST.class) != null) {
+                return true;
+            }
+            for (Annotation annotation : m.getAnnotations()) {
+                InterceptorAnnotation interceptorAnnotation = annotation.annotationType().getAnnotation(InterceptorAnnotation.class);
+                if (interceptorAnnotation != null && interceptorAnnotation.value() == HttpVerbInterceptor.class) {
+                    // see org.kohsuke.stapler.verb.HttpVerbInterceptor
+                    return true;
+                }
+            }
+            return false;
+        }
+
+        private boolean isStaplerDispatchable(Method m) {
+            if (m.isBridge()) {
+                return false;
+            }
+            if (m.isSynthetic()) {
+                return false;
+            }
+            if (!Modifier.isPublic(m.getModifiers())) {
+                return false;
+            }
+            String name = m.getName();
+            if (!name.startsWith("do") && m.getAnnotation(WebMethod.class) == null) {
+                return false;
+            }
+            return true;
+        }
+
+        private static Logger LOGGER = Logger.getLogger(OtherTests.class.getName());
     }
 }

src/test/java/org/jvnet/hudson/test/JenkinsRuleTest.java

@@ -81,6 +81,7 @@ public void assertEqualDataBoundBeansWithSettersFailForField() throws Exception
     @Test
     public void testTokenHelperMethods() throws Exception {
         j.jenkins.setSecurityRealm(j.createDummySecurityRealm());
+        // Jenkins 2.129+: ApiTokenPropertyConfiguration.get().setTokenGenerationOnCreationEnabled(true);
 
         JenkinsRule.WebClient wc = j.createWebClient();