[SECURITY-3300]

jenkinsci · Feb 28, 2024 · 6aa2a23 · 6aa2a23
1 parent e4f044c
commit 6aa2a23
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/ForkPullRequestDiscoveryTrait.java b/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/ForkPullRequestDiscoveryTrait.java
@@ -301,7 +301,16 @@ public TrustTeamForks() {
         @Override
         protected boolean checkTrusted(@NonNull BitbucketSCMSourceRequest request, @NonNull PullRequestSCMHead head)
                 throws IOException, InterruptedException {
-            if (!head.getOrigin().equals(SCMHeadOrigin.DEFAULT)) {
+            SCMHeadOrigin origin = head.getOrigin();
+            if (!origin.equals(SCMHeadOrigin.DEFAULT)) {
+                if(origin instanceof SCMHeadOrigin.Fork) {
+                    String forkOwner = ((SCMHeadOrigin.Fork) origin).getName();
+                    int index = forkOwner.lastIndexOf('/');
+                    if (index > 0) { //hasn't happened yet in my testing, so this might be wrong
+                        forkOwner = forkOwner.substring(0, index);
+                    }
+                    return request.getRepoOwner().equalsIgnoreCase(forkOwner);
+                }
                 return head.getRepoOwner().equalsIgnoreCase(request.getRepoOwner());
             }
             return false;