Merge 2.319 security fixes back into master

[daniel-beck]

Trial PR to see whether this builds on CI. If it does, I'll push to master directly.

Meanwhile, 2.319 is at https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.319

[jglick]

I'll push to master directly.

Why not simply merge this PR?

[daniel-beck]

Passed enough (some sort of ATH infra failure?)

[timja]

Passed enough (some sort of ATH infra failure?)

Not infra, can be reproduced locally, appears to be security regression: https://issues.jenkins.io/browse/JENKINS-67063?focusedCommentId=415616&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-415616

[jglick]

I think a deleteDir() before https://github.com/jenkins-infra/pipeline-library/blob/4fd036d1da36d5dc9313d6f048b1f67f82cb0a3b/vars/runATH.groovy#L97 may solve it. Something weird with symlinks.

[timja]

gets past it locally for me

[jglick]

jenkins/core/src/main/java/hudson/FilePath.java

Line 2840 in d563512

File f = new File(baseDir, te.getName()).getCanonicalFile();

is wrong I think. Trying to figure out how this should work instead.

[timja]

the deleteDir has unblocked ATH

[jglick]

check #5886