Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-34650

Allow global libraries to bypass the sandbox

XMLWordPrintable

      Although you are required to have RUN_SCRIPTS to push anything to workflowLibs, the code is run under the same sandbox settings as the main Pipeline scripts. In the case of a Pipeline script using whole-script approval, it makes sense to be checking RUN_SCRIPTS for libraries. But in the case of Pipeline scripts configured to use the Groovy sandbox, the workflowLibs code is also run in the sandbox—a pointless restriction, since only a trusted user could have written that code. You would expect that the library code would be trusted and run in a privileged mode, so it could safely encapsulate otherwise unsafe method calls.

          [JENKINS-34650] Allow global libraries to bypass the sandbox

          Jesse Glick created issue -

          Jesse Glick added a comment -

          JENKINS-26538 requests the converse, in a sense: libraries that regular users could upload but which could not run unsafe methods.

          Jesse Glick added a comment - JENKINS-26538 requests the converse, in a sense: libraries that regular users could upload but which could not run unsafe methods.
          Jesse Glick made changes -
          Link New: This issue is related to JENKINS-26538 [ JENKINS-26538 ]
          Jesse Glick made changes -
          Remote Link New: This issue links to "PR 2 (Web Link)" [ 14275 ]
          Jesse Glick made changes -
          Epic Link New: JENKINS-35391 [ 171184 ]

          Kohsuke Kawaguchi added a comment -

          I'm going to work on this in the context of https://github.com/cloudbees/groovy-cps/pull/36

          Kohsuke Kawaguchi added a comment - I'm going to work on this in the context of https://github.com/cloudbees/groovy-cps/pull/36
          Kohsuke Kawaguchi made changes -
          Remote Link New: This issue links to "Groovy CPS change (Web Link)" [ 14658 ]
          R. Tyler Croy made changes -
          Workflow Original: JNJira [ 170820 ] New: JNJira + In-Review [ 184058 ]
          Kohsuke Kawaguchi made changes -
          Remote Link New: This issue links to "workflow-cps-plugin PR #33 (Web Link)" [ 14662 ]

          Kohsuke Kawaguchi added a comment -

          This is the entry point into this series of changes

          Kohsuke Kawaguchi added a comment - This is the entry point into this series of changes
          Kohsuke Kawaguchi made changes -
          Remote Link New: This issue links to "workflow-cps-global-lib-plugin #8 (Web Link)" [ 14663 ]

            kohsuke Kohsuke Kawaguchi
            jglick Jesse Glick
            Votes:
            0 Vote for this issue
            Watchers:
            7 Start watching this issue

              Created:
              Updated:
              Resolved: