Enhance Gatling plugin security and UI

README.md

@@ -13,7 +13,7 @@ stress tool, with Jenkins.
 
 This plugin allows you to : 
 
-- Keep track of a Gatling simulation, providing performance trends across builds
+- Keep track of a Gatling simulation, providing performance trends across builds(Enterprise Only)
 - Download the detailed reports for each build
 
 ## Changelog
@@ -115,7 +115,7 @@ The Gatling entry in the left summary has two purposes, depending on
 which page you are.
 
 If you are on the project dashboard, clicking on Gatling will get you to
-a more detailed performance trend, displaying for your last 30 builds :
+a more detailed performance trend(Enterprise only), displaying for your last 30 builds :
 
 -   Mean response time trend
 -   95th percentiles response time trend
@@ -125,7 +125,7 @@ This page will also provides links to download the html reports for all your
 builds, at the bottom of the page.
 
 If you are on the summary of a specific build, clicking on Gatling will
-get you to a list of all available reports for this build.
+get you to a list of all available reports for this build without the graph(Enterprise only).
 
 ## Bug Reporting
 

pom.xml

@@ -88,6 +88,13 @@
 			<artifactId>jackson2-api</artifactId>
 		</dependency>
 
+		<!-- OWASP HTML Sanitizer -->
+		<dependency>
+			<groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
+			<artifactId>owasp-java-html-sanitizer</artifactId>
+			<version>20211018.2</version>
+		</dependency>
+
 		<!-- dependencies on Jenkins Pipeline plugins -->
 		<dependency>
 			<groupId>org.jenkins-ci.plugins.workflow</groupId>
@@ -113,6 +120,30 @@
 	<build>
 		<pluginManagement>
 			<plugins>
+				<plugin>
+					<groupId>com.diffplug.spotless</groupId>
+					<artifactId>spotless-maven-plugin</artifactId>
+					<version>2.44.5</version>
+					<configuration>
+						<java>
+							<googleJavaFormat>
+								<version>1.27.0</version>
+								<style>GOOGLE</style>
+							</googleJavaFormat>
+							<removeUnusedImports/>
+							<importOrder>
+								<order>java,javax,org,com,</order>
+							</importOrder>
+						</java>
+					</configuration>
+					<executions>
+						<execution>
+							<goals>
+								<goal>check</goal>
+							</goals>
+						</execution>
+					</executions>
+				</plugin>
 				<plugin>
 					<groupId>com.mycila.maven-license-plugin</groupId>
 					<artifactId>maven-license-plugin</artifactId>

src/main/java/io/gatling/jenkins/BuildSimulation.java

@@ -1,27 +1,25 @@
 /**
  * Copyright 2011-2020 GatlingCorp (http://gatling.io)
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * <p>Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of the License at
  *
- * 		http://www.apache.org/licenses/LICENSE-2.0
+ * <p>http://www.apache.org/licenses/LICENSE-2.0
  *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
+ * <p>Unless required by applicable law or agreed to in writing, software distributed under the
+ * License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing permissions and
  * limitations under the License.
  */
 package io.gatling.jenkins;
 
-import hudson.FilePath;
 import java.io.File;
 
+import hudson.FilePath;
+
 /**
- * This class is basically just a struct to hold information about one
- * or more gatling simulations that were archived for a given
- * instance of {@link GatlingBuildAction}.
+ * This class is basically just a struct to hold information about one or more gatling simulations
+ * that were archived for a given instance of {@link GatlingBuildAction}.
  */
 public class BuildSimulation {
   private final String simulationName;
@@ -35,12 +33,12 @@ public BuildSimulation(String simulationName, RequestReport requestReport, File
   }
 
   // see https://wiki.jenkins.io/display/JENKINS/Hint+on+retaining+backward+compatibility
-  @Deprecated
-  private transient FilePath simulationDirectory;
+  @Deprecated private transient FilePath simulationDirectory;
+
   @SuppressWarnings("unused")
   private Object readResolve() {
     if (simulationDirectory != null) {
-        simulationPath = new File(simulationDirectory.getRemote());
+      simulationPath = new File(simulationDirectory.getRemote());
     }
     return this;
   }

src/main/java/io/gatling/jenkins/GatlingBuildAction.java

@@ -1,43 +1,40 @@
 /**
  * Copyright 2011-2020 GatlingCorp (http://gatling.io)
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * <p>Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of the License at
  *
- * 		http://www.apache.org/licenses/LICENSE-2.0
+ * <p>http://www.apache.org/licenses/LICENSE-2.0
  *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
+ * <p>Unless required by applicable law or agreed to in writing, software distributed under the
+ * License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing permissions and
  * limitations under the License.
  */
 package io.gatling.jenkins;
 
 import static io.gatling.jenkins.PluginConstants.*;
 
-import hudson.model.Action;
-import hudson.model.Run;
-import jenkins.tasks.SimpleBuildStep;
-
 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 
+import hudson.model.Action;
+import hudson.model.Run;
+import jenkins.tasks.SimpleBuildStep;
+
 /**
  * An Action to add to a project/job's build/run page in the UI.
  *
- * Note that in order to be compatible with the new Jenkins Pipeline jobs,
- * Actions that should be added to the project/job's page directly must be added
- * by implementing the SimpleBuildStep.LastBuildAction interface, and encapsulating
- * the project actions in the build action via the getProjectActions method.
+ * <p>Note that in order to be compatible with the new Jenkins Pipeline jobs, Actions that should be
+ * added to the project/job's page directly must be added by implementing the
+ * SimpleBuildStep.LastBuildAction interface, and encapsulating the project actions in the build
+ * action via the getProjectActions method.
  *
- * This is necessary and now preferred to the old approach of defining getProjectAction
- * directly on the Publisher, because for a Pipeline job, Jenkins doesn't know ahead
- * of time what actions will be triggered, and will never call the Publisher.getProjectAction
- * method.  Attaching it as a LastBuildAction means that it is discoverable once
- * the Pipeline job has been run once.
+ * <p>This is necessary and now preferred to the old approach of defining getProjectAction directly
+ * on the Publisher, because for a Pipeline job, Jenkins doesn't know ahead of time what actions
+ * will be triggered, and will never call the Publisher.getProjectAction method. Attaching it as a
+ * LastBuildAction means that it is discoverable once the Pipeline job has been run once.
  */
 public class GatlingBuildAction implements Action, SimpleBuildStep.LastBuildAction {
 
@@ -70,11 +67,11 @@
   }
 
   /**
-   * This method is called dynamically for any HTTP request to our plugin's
-   * URL followed by "/report/reportName".
+   * This method is called dynamically for any HTTP request to our plugin's URL followed by
+   * "/report/reportName".
    *
-   * It returns a new instance of {@link ReportViewer}, which contains the
-   * actual logic for downloading a report.
+   * <p>It returns a new instance of {@link ReportViewer}, which contains the actual logic for
+   * downloading a report.
    *
    * @param reportName the name of the reportName
    */
@@ -84,11 +81,22 @@
     return simulation != null ? new ReportViewer(simulation) : null;
   }
 
+  @SuppressWarnings("unused")
+  public ReportDownloader getDownload(String reportName) {
+    BuildSimulation simulation = getSimulationByReportName(reportName);
+    return simulation != null ? new ReportDownloader(simulation) : null;
+  }
+
   @SuppressWarnings("unused")
   public String getReportURL(BuildSimulation simulation) {
     return URL_NAME + "/report/" + simulation.getSimulationDirectory().getName();
   }
 
+  @SuppressWarnings("unused")
+  public String getDownloadURL(BuildSimulation simulation) {
+    return URL_NAME + "/download/" + simulation.getSimulationDirectory().getName();
+  }
+
   private BuildSimulation getSimulationByReportName(String reportName) {
     for (BuildSimulation sim : this.getSimulations()) {
       if (sim.getSimulationDirectory().getName().equals(reportName)) {

src/main/java/io/gatling/jenkins/GatlingProjectAction.java

@@ -1,29 +1,26 @@
 /**
  * Copyright 2011-2020 GatlingCorp (http://gatling.io)
  *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
+ * <p>Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of the License at
  *
- * 		http://www.apache.org/licenses/LICENSE-2.0
+ * <p>http://www.apache.org/licenses/LICENSE-2.0
  *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
+ * <p>Unless required by applicable law or agreed to in writing, software distributed under the
+ * License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
+ * express or implied. See the License for the specific language governing permissions and
  * limitations under the License.
  */
 package io.gatling.jenkins;
 
 import static io.gatling.jenkins.PluginConstants.*;
 
-import hudson.model.*;
-
+import java.util.ArrayList;
 import java.util.LinkedHashMap;
-import java.util.Map;
 import java.util.List;
-import java.util.ArrayList;
+import java.util.Map;
 
+import hudson.model.*;
 import io.gatling.jenkins.chart.Graph;
 
 public class GatlingProjectAction implements Action {
@@ -96,7 +93,10 @@
     return new Graph<Long>(job, MAX_BUILDS_TO_DISPLAY) {
       @Override
       public Long getValue(RequestReport requestReport) {
-        return Math.round(requestReport.getNumberOfRequests().getKO() * 100.0 / requestReport.getNumberOfRequests().getTotal());
+        return Math.round(
+            requestReport.getNumberOfRequests().getKO()
+                * 100.0
+                / requestReport.getNumberOfRequests().getTotal());
       }
     };
   }