Workaround/replace/remove unmaintained Jenkins plugins

[Houkime]

Abandoned extremely old plugins are potential security and integration hazards.
If there's a possibility to do so, dependency on them should be removed or effort should be made to maintain them again.

List of the least maintained plugins used in LCCI as of 7.11.17:

filesystem_scm:
(WARNING!) Extremely old (6y since last release) plugin.
Tracks changes in the filesystem like it was an SCM repo.
Oleg Nenashev got control over plugin and currently tries to modernize it.
Github repo

saferestart:
(WARNING!!!) Extremely old plugin (5y since last release). Allows restarting Jenkins safely: it's waiting till all builds in progress finish before launching restart.

simple-theme-plugin:
(WARNING!!!) Extremely old plugin (5y since release).
Custom CSS styling and JS on the page.
(WARNING!!!) Potentially hazardous due to its nature and age.

description-setter:
(WARNING!) Old plugin (3y since last release).
Sets build description based on build logs.

log-parser:
(WARNING!) Old plugin (2y since release).
Parses Jenkins CI build logs and collects warnings and errors.

[oleg-nenashev]

As I Jenkins contributor/user, I would say that 4 plugins are more or less fine. FileSystem SCM plugin is not fine for sure, but I am working on its facelift.

Do you have any specific concerns about other plugins in the list?

[Houkime]

My personal biggest concern is simple-theme-plugin. Client-side Javascript and XSS threats are real and if you choose to use Java web UI at all you should try to be up to date at all costs. It's not only about server security but about user security.
If it is realistical I would recommend to exclude client-side JS completely. Maybe I'm bit paranoid because I tried to make tor services one day but still.

[oleg-nenashev]

Sorry, missed the update

If it is realistical I would recommend to exclude client-side JS completely. Maybe I'm bit paranoid because I tried to make tor services one day but still.

It is not realistic in Jenkins. It moves towards Javascript UIs. The Simple Theme plugin itself is not a security risk, a vulnerable theme would need to be explicitly configured. I would be rather aware about BlueOcean in such case.

I will think whether it is possible to add feature flags to the packaging.

[oleg-nenashev]

FileSystem SCM will be updated in #40