Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-26541

Rejected sandbox methods inside parallel not being recorded for approval

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Major Major
    • pipeline
    • None

      I tried to run the CD demo in the sandbox and got

      org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use staticMethod java.util.UUID randomUUID
	at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectStaticMethod(StaticWhitelist.java:164)
	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onStaticCall(SandboxInterceptor.java:100)
	at org.kohsuke.groovy.sandbox.impl.Checker$2.call(Checker.java:115)
	at org.kohsuke.groovy.sandbox.impl.Checker.checkedStaticCall(Checker.java:112)
	at org.kohsuke.groovy.sandbox.impl.Checker.checkedCall(Checker.java:81)
	at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.methodCall(SandboxInvoker.java:15)
	at WorkflowScript.runWithServer(WorkflowScript:47)
	at WorkflowScript.run(WorkflowScript:16)
	at Unknown.Unknown(Unknown)
	at ___cps.transform___(Native Method)
	at com.cloudbees.groovy.cps.impl.ContinuationGroup.methodCall(ContinuationGroup.java:69)

      Fine, but then http://localhost:8081/scriptApproval/ did not list the rejected method. Is SandboxContinuable not calling ScriptApproval.accessRejected?

          [JENKINS-26541] Rejected sandbox methods inside parallel not being recorded for approval

          Jesse Glick added a comment -

          It works normally, but not inside parallel.

          Jesse Glick added a comment - It works normally, but not inside parallel .

          SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Jesse Glick
          Path:
          aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java
          cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java
          http://jenkins-ci.org/commit/workflow-plugin/fb174fdabbb46f9f84ef84a83dcccaa85252713f
          Log:
          [FIXED JENKINS-26541] Need to check for RejectedAccessException wrapped in ParallelStepException.

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java http://jenkins-ci.org/commit/workflow-plugin/fb174fdabbb46f9f84ef84a83dcccaa85252713f Log: [FIXED JENKINS-26541] Need to check for RejectedAccessException wrapped in ParallelStepException.

          SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Jesse Glick
          Path:
          CHANGES.md
          http://jenkins-ci.org/commit/workflow-plugin/d31a8d7b9e6ba7af9dbe238be0e4c2162720b5e3
          Log:
          JENKINS-26541 Noting.

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: CHANGES.md http://jenkins-ci.org/commit/workflow-plugin/d31a8d7b9e6ba7af9dbe238be0e4c2162720b5e3 Log: JENKINS-26541 Noting.

          SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Jesse Glick
          Path:
          CHANGES.md
          aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java
          cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java
          http://jenkins-ci.org/commit/workflow-plugin/b83b89dc448e402d34a7741537f7de675293c5f9
          Log:
          Merge pull request #43 from jenkinsci/RejectedAccessException-parallel-JENKINS-26541

          JENKINS-26541 Handle wrapped RejectedAccessException

          Compare: https://github.com/jenkinsci/workflow-plugin/compare/8f9dc9acc102...b83b89dc448e

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: CHANGES.md aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java http://jenkins-ci.org/commit/workflow-plugin/b83b89dc448e402d34a7741537f7de675293c5f9 Log: Merge pull request #43 from jenkinsci/RejectedAccessException-parallel- JENKINS-26541 JENKINS-26541 Handle wrapped RejectedAccessException Compare: https://github.com/jenkinsci/workflow-plugin/compare/8f9dc9acc102...b83b89dc448e

          SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Jesse Glick
          Path:
          aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java
          cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java
          http://jenkins-ci.org/commit/workflow-cps-plugin/c99b9570aba68c4ab2952892ec7ec94662b8fd29
          Log:
          [FIXED JENKINS-26541] Need to check for RejectedAccessException wrapped in ParallelStepException.
          Originally-Committed-As: fb174fdabbb46f9f84ef84a83dcccaa85252713f

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java http://jenkins-ci.org/commit/workflow-cps-plugin/c99b9570aba68c4ab2952892ec7ec94662b8fd29 Log: [FIXED JENKINS-26541] Need to check for RejectedAccessException wrapped in ParallelStepException. Originally-Committed-As: fb174fdabbb46f9f84ef84a83dcccaa85252713f

            jglick Jesse Glick
            jglick Jesse Glick
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: