[JENKINS-39742] Active Choice Plugin should honor ParameterDefinition serializability (was: Active Choice Plugin in Pipelines throw NotSerializableException)

Type: Bug
Resolution: Fixed
Priority: Major
Component/s: active-choices-plugin
Labels:
Environment:
Jenkins 2.19.1
Pipeline 2.4
Pipeline: Groovy 2.23
Active Choices Plug-in: 1.5.1

Similar Issues:
Powered by SuggestiMate

Show
Released As:
script-security 1.72

Since upgrading to Pipeline: Active Choices Plug-in: 1.5.1 the Groovy script is no longer serializable and therefore throws NotSerializableException when input is requested.

Stacktrace

java.io.NotSerializableException: org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript
	at org.jboss.marshalling.river.RiverMarshaller.doWriteObject(RiverMarshaller.java:860)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteFields(RiverMarshaller.java:1032)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteSerializableObject(RiverMarshaller.java:988)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteObject(RiverMarshaller.java:854)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteFields(RiverMarshaller.java:1032)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteSerializableObject(RiverMarshaller.java:988)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteSerializableObject(RiverMarshaller.java:967)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteObject(RiverMarshaller.java:854)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteObject(RiverMarshaller.java:569)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteFields(RiverMarshaller.java:1032)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteSerializableObject(RiverMarshaller.java:988)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteObject(RiverMarshaller.java:854)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteFields(RiverMarshaller.java:1032)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteSerializableObject(RiverMarshaller.java:988)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteObject(RiverMarshaller.java:854)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteFields(RiverMarshaller.java:1032)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteSerializableObject(RiverMarshaller.java:988)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteObject(RiverMarshaller.java:854)
	at org.jboss.marshalling.river.BlockMarshaller.doWriteObject(BlockMarshaller.java:65)
	at org.jboss.marshalling.river.BlockMarshaller.writeObject(BlockMarshaller.java:56)
	at org.jboss.marshalling.MarshallerObjectOutputStream.writeObjectOverride(MarshallerObjectOutputStream.java:50)
	at org.jboss.marshalling.river.RiverObjectOutputStream.writeObjectOverride(RiverObjectOutputStream.java:179)
	at java.io.ObjectOutputStream.writeObject(ObjectOutputStream.java:344)
	at java.util.TreeMap.writeObject(TreeMap.java:2434)
	at sun.reflect.GeneratedMethodAccessor357.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:483)
	at org.jboss.marshalling.reflect.SerializableClass.callWriteObject(SerializableClass.java:271)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteSerializableObject(RiverMarshaller.java:976)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteObject(RiverMarshaller.java:854)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteFields(RiverMarshaller.java:1032)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteSerializableObject(RiverMarshaller.java:988)
	at org.jboss.marshalling.river.RiverMarshaller.doWriteObject(RiverMarshaller.java:854)
	at org.jboss.marshalling.AbstractObjectOutput.writeObject(AbstractObjectOutput.java:58)
	at org.jboss.marshalling.AbstractMarshaller.writeObject(AbstractMarshaller.java:111)
	at org.jenkinsci.plugins.workflow.support.pickles.serialization.RiverWriter.writeObject(RiverWriter.java:132)
	at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.saveProgram(CpsThreadGroup.java:433)
	at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.saveProgram(CpsThreadGroup.java:412)
	at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.run(CpsThreadGroup.java:357)
	at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.access$100(CpsThreadGroup.java:78)
	at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:236)
	at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:224)
	at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$2.call(CpsVmExecutorService.java:63)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at hudson.remoting.SingleLaneExecutorService$1.run(SingleLaneExecutorService.java:112)
	at jenkins.util.ContextResettingExecutorService$1.run(ContextResettingExecutorService.java:28)
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
	at java.lang.Thread.run(Thread.java:745)
Caused by: an exception which occurred:
	in field secureFallbackScript
	in field script
	in field parameters
	in field input
	in field step
	in field threads
	in object org.jenkinsci.plugins.workflow.cps.CpsThreadGroup@7145f3ac

Pipeline Code

node {
    def inputValues
    def yesNo = readFile(env.JENKINS_ROOT + '/dropdowns/yesno.txt')
    
    stage('Build Properties') {
        inputValues = input(
            id: 'userInput', message: 'AutoDeploy', ok: 'GO GO GO',
            parameters: [
                [
                    $class: 'ChoiceParameter', choiceType: 'PT_RADIO', description: 'Auto-deploy after upload', filterable: false, name: 'autodeploy', randomName: 'choice-para-9552882322810329', script: [$class: 'GroovyScript', fallbackScript: [classpath: [], sandbox: true, script: ''], script: [classpath: [], sandbox: true, script: yesNo]]
                ]
            ]
        )
    }
}

EDIT: Further analysis

The "Serializable chain" seems to be broken:

Active Choice Plugin parameters implement Serializable via ParameterDefinition inheritance
Those implementation can happen to contain a non-transient GroovyScript
GroovyScript implements Serializable (via Script) but also contains a non-transient SecureGroovyScript
SecureGroovyScript does not implement Serializable

The Pipeline/Pipeline-input-step plugin happens to be one of the components making actual use of the ParameterDefinition implements Serializable contract but this issue isn't strictly tied to pipelines.

relates to

JENKINS-28732 Add support to the script security plug-in to Active Choices

Closed

links to

jenkinsci/script-security-plugin#292

Bruno P. Kinoshita added a comment - 2017-03-03 11:28

Hi fchuong,

I marked the issue as resolved as I thought it was related strictly to the pipelines support.

You have a good argument I'm keen to spend some time investigating how we could fix it (we just need - probably - look at some other plug-in that does that) and then can discuss pipeline support in a separate issue as you suggested.

Feel free to move the issue to the status you find more appropriate. We had a BioUno meeting recently, and I am going to triage issues in the next days to prepare a new release. This one looks like a low hanging fruit to include.

Cheers
Bruno

Bruno P. Kinoshita added a comment - 2017-03-03 11:28 Hi fchuong , I marked the issue as resolved as I thought it was related strictly to the pipelines support. You have a good argument I'm keen to spend some time investigating how we could fix it (we just need - probably - look at some other plug-in that does that) and then can discuss pipeline support in a separate issue as you suggested. Feel free to move the issue to the status you find more appropriate. We had a BioUno meeting recently, and I am going to triage issues in the next days to prepare a new release. This one looks like a low hanging fruit to include. Cheers Bruno

Frédéric Chuong added a comment - 2017-03-03 15:58

Thanks kinow, I'll update the issue details accordingly.
As a first guess, the simplest approach (from the Active Choice Plugin point of view) would be checking with script-security maintainers to see whether SecureGroovyScript could be enhanced to implement Serializable. If that is possible, then it would be a matter of upgrading the script-security dependency to fix this issue.

Frédéric Chuong added a comment - 2017-03-03 15:58 Thanks kinow , I'll update the issue details accordingly. As a first guess, the simplest approach (from the Active Choice Plugin point of view) would be checking with script-security maintainers to see whether SecureGroovyScript could be enhanced to implement Serializable . If that is possible, then it would be a matter of upgrading the script-security dependency to fix this issue.

Jesse Glick added a comment - 2017-04-24 15:54

Introduced in ~~JENKINS-28732~~?

I think SecureGroovyScript could be made Serializable.

Jesse Glick added a comment - 2017-04-24 15:54 Introduced in JENKINS-28732 ? I think SecureGroovyScript could be made Serializable .

Jesse Glick added a comment - 2017-04-24 15:55

…at least when sandbox: true. Otherwise it is going to be too complicated to reason about.

Jesse Glick added a comment - 2017-04-24 15:55 …at least when sandbox: true . Otherwise it is going to be too complicated to reason about.

chris starling added a comment - 2018-10-26 14:03

I'm wondering if pipeline support has been added since this ticket, or is there a plan to add support for it?

chris starling added a comment - 2018-10-26 14:03 I'm wondering if pipeline support has been added since this ticket, or is there a plan to add support for it?

shagun jian added a comment - 2020-02-10 16:09

I am also facing this issue, was the fix for NotSerializableException been released?

shagun jian added a comment - 2020-02-10 16:09 I am also facing this issue, was the fix for NotSerializableException been released?

Ben Courliss added a comment - 2020-05-08 16:52

Would be nice to see if this could be fixed. Would love to use ActiveChoices in my declarative pipelines. Ran into this issue today so I'm falling back to a freestyle job.

Ben Courliss added a comment - 2020-05-08 16:52 Would be nice to see if this could be fixed. Would love to use ActiveChoices in my declarative pipelines. Ran into this issue today so I'm falling back to a freestyle job.

Devin Nusbaum added a comment - 2020-05-11 20:11

A fix for the serialization errors was released in version 1.72 of Script Security plugin.

Devin Nusbaum added a comment - 2020-05-11 20:11 A fix for the serialization errors was released in version 1.72 of Script Security plugin.

Bruno P. Kinoshita added a comment - 2020-05-11 22:21

Thanks for the note dnusbaum! Will try to update it before next release of active-choices.

Bruno P. Kinoshita added a comment - 2020-05-11 22:21 Thanks for the note dnusbaum ! Will try to update it before next release of active-choices.

Bruno P. Kinoshita added a comment - 2020-05-16 07:00

Will upgrade to 1.72 in 2.3, https://github.com/jenkinsci/active-choices-plugin/pull/34

Bruno P. Kinoshita added a comment - 2020-05-16 07:00 Will upgrade to 1.72 in 2.3, https://github.com/jenkinsci/active-choices-plugin/pull/34

Assignee:: Bruno P. Kinoshita

Reporter:: jsclinton

Votes:: 3 Vote for this issue

Watchers:: 11 Start watching this issue

Created:: 2016-11-15 12:21

Updated:: 2020-05-16 07:00

Resolved:: 2020-05-11 19:04

Details

Description

Stacktrace

Pipeline Code

EDIT: Further analysis

Attachments

Issue Links

Activity

Collapse comment: Bruno P. Kinoshita added a comment - 2017-03-03 11:28

Expand comment: Bruno P. Kinoshita added a comment - 2017-03-03 11:28

Collapse comment: Frédéric Chuong added a comment - 2017-03-03 15:58

Expand comment: Frédéric Chuong added a comment - 2017-03-03 15:58

Collapse comment: Jesse Glick added a comment - 2017-04-24 15:54

Expand comment: Jesse Glick added a comment - 2017-04-24 15:54

Collapse comment: Jesse Glick added a comment - 2017-04-24 15:55

Expand comment: Jesse Glick added a comment - 2017-04-24 15:55

Collapse comment: chris starling added a comment - 2018-10-26 14:03

Expand comment: chris starling added a comment - 2018-10-26 14:03

Collapse comment: shagun jian added a comment - 2020-02-10 16:09

Expand comment: shagun jian added a comment - 2020-02-10 16:09

Collapse comment: Ben Courliss added a comment - 2020-05-08 16:52

Expand comment: Ben Courliss added a comment - 2020-05-08 16:52

Collapse comment: Devin Nusbaum added a comment - 2020-05-11 20:11

Expand comment: Devin Nusbaum added a comment - 2020-05-11 20:11

Collapse comment: Bruno P. Kinoshita added a comment - 2020-05-11 22:21

Expand comment: Bruno P. Kinoshita added a comment - 2020-05-11 22:21

Collapse comment: Bruno P. Kinoshita added a comment - 2020-05-16 07:00

Expand comment: Bruno P. Kinoshita added a comment - 2020-05-16 07:00

People

Dates