-
Bug
-
Resolution: Cannot Reproduce
-
Major
-
None
-
2.60.1
We have rather complex build scripts in groovy to deal. After upgrade to 2.60.1 they start fail with:
*14:18:45* ERROR: Build step failed with exception*14:18:45* org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: unclassified field java.io.File text*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.unclassifiedField(SandboxInterceptor.java:367)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onSetProperty(SandboxInterceptor.java:217)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$5.call(Checker.java:297)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker.checkedSetProperty(Checker.java:294)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$checkedSetProperty$2.callStatic(Unknown Source)*14:18:45* at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallStatic(CallSiteArray.java:56)*14:18:45* at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callStatic(AbstractCallSite.java:194)*14:18:45* at Script1.run(Script1.groovy:11)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.run(GroovySandbox.java:141)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:165)*14:18:45* at hudson.plugins.groovy.SystemGroovy.run(SystemGroovy.java:95)*14:18:45* at hudson.plugins.groovy.SystemGroovy.perform(SystemGroovy.java:59)*14:18:45* at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:735)*14:18:45* at hudson.model.Build$BuildExecution.build(Build.java:206)*14:18:45* at hudson.model.Build$BuildExecution.doRun(Build.java:163)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:490)*14:18:45* at hudson.model.Run.execute(Run.java:1735)*14:18:45* at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)*14:18:45* at hudson.model.ResourceController.execute(ResourceController.java:97)*14:18:45* at hudson.model.Executor.run(Executor.java:405)*14:18:45* Build step 'Execute system Groovy script' marked build as failure
Issues
- the 'field java.io.File text' was not offered in /scriptApproval
- after being added manually in xml it still failing with the same error (though i can see it in 'Signatures already approved')
- Permissive security plugin doesn't help
So, we ended up with completely broken builds without any fallback options.
Job Configuration
Problematic step: Execute system Groovy script + Groovy script file
Code:
final File tmp = File.createTempFile(...) tmp.text = build.project.workspace.child('somefile').readToString()
- links to
[JENKINS-45308] unclassified field java.io.File text
| Description |
Original:
We have rather complex build scripts in groovy to deal. After upgrade to 2.60.1 they start fail with: \{code} *14:18:45* ERROR: Build step failed with exception*14:18:45* org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: unclassified field java.io.File text*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.unclassifiedField(SandboxInterceptor.java:367)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onSetProperty(SandboxInterceptor.java:217)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$5.call(Checker.java:297)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker.checkedSetProperty(Checker.java:294)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$checkedSetProperty$2.callStatic(Unknown Source)*14:18:45* at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallStatic(CallSiteArray.java:56)*14:18:45* at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callStatic(AbstractCallSite.java:194)*14:18:45* at Script1.run(Script1.groovy:11)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.run(GroovySandbox.java:141)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:165)*14:18:45* at hudson.plugins.groovy.SystemGroovy.run(SystemGroovy.java:95)*14:18:45* at hudson.plugins.groovy.SystemGroovy.perform(SystemGroovy.java:59)*14:18:45* at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:735)*14:18:45* at hudson.model.Build$BuildExecution.build(Build.java:206)*14:18:45* at hudson.model.Build$BuildExecution.doRun(Build.java:163)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:490)*14:18:45* at hudson.model.Run.execute(Run.java:1735)*14:18:45* at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)*14:18:45* at hudson.model.ResourceController.execute(ResourceController.java:97)*14:18:45* at hudson.model.Executor.run(Executor.java:405)*14:18:45* Build step 'Execute system Groovy script' marked build as failure \{code} Issues: # the 'field java.io.File text' was not offered in /scriptApproval # after being added manually in xml it still failing with the same error (though i can see it in 'Signatures already approved') # Permissive security plugin doesn't help So, we ended up with completely broken builds without any fallback options. Job Configuration Problematic step: Execute system Groovy script + Groovy script file Code: {code} final File tmp = File.createTempFile(...) tmp.text = build.project.workspace.child('somefile').readToString() {code} |
New:
We have rather complex build scripts in groovy to deal. After upgrade to 2.60.1 they start fail with: {code} *14:18:45* ERROR: Build step failed with exception*14:18:45* org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: unclassified field java.io.File text*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.unclassifiedField(SandboxInterceptor.java:367)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onSetProperty(SandboxInterceptor.java:217)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$5.call(Checker.java:297)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker.checkedSetProperty(Checker.java:294)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$checkedSetProperty$2.callStatic(Unknown Source)*14:18:45* at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallStatic(CallSiteArray.java:56)*14:18:45* at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callStatic(AbstractCallSite.java:194)*14:18:45* at Script1.run(Script1.groovy:11)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.run(GroovySandbox.java:141)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:165)*14:18:45* at hudson.plugins.groovy.SystemGroovy.run(SystemGroovy.java:95)*14:18:45* at hudson.plugins.groovy.SystemGroovy.perform(SystemGroovy.java:59)*14:18:45* at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:735)*14:18:45* at hudson.model.Build$BuildExecution.build(Build.java:206)*14:18:45* at hudson.model.Build$BuildExecution.doRun(Build.java:163)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:490)*14:18:45* at hudson.model.Run.execute(Run.java:1735)*14:18:45* at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)*14:18:45* at hudson.model.ResourceController.execute(ResourceController.java:97)*14:18:45* at hudson.model.Executor.run(Executor.java:405)*14:18:45* Build step 'Execute system Groovy script' marked build as failure {code} Issues: # the 'field java.io.File text' was not offered in /scriptApproval # after being added manually in xml it still failing with the same error (though i can see it in 'Signatures already approved') # Permissive security plugin doesn't help So, we ended up with completely broken builds without any fallback options. Job Configuration Problematic step: Execute system Groovy script + Groovy script file Code: {code} final File tmp = File.createTempFile(...) tmp.text = build.project.workspace.child('somefile').readToString() {code} |
| Description |
Original:
We have rather complex build scripts in groovy to deal. After upgrade to 2.60.1 they start fail with: {code} *14:18:45* ERROR: Build step failed with exception*14:18:45* org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: unclassified field java.io.File text*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.unclassifiedField(SandboxInterceptor.java:367)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onSetProperty(SandboxInterceptor.java:217)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$5.call(Checker.java:297)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker.checkedSetProperty(Checker.java:294)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$checkedSetProperty$2.callStatic(Unknown Source)*14:18:45* at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallStatic(CallSiteArray.java:56)*14:18:45* at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callStatic(AbstractCallSite.java:194)*14:18:45* at Script1.run(Script1.groovy:11)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.run(GroovySandbox.java:141)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:165)*14:18:45* at hudson.plugins.groovy.SystemGroovy.run(SystemGroovy.java:95)*14:18:45* at hudson.plugins.groovy.SystemGroovy.perform(SystemGroovy.java:59)*14:18:45* at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:735)*14:18:45* at hudson.model.Build$BuildExecution.build(Build.java:206)*14:18:45* at hudson.model.Build$BuildExecution.doRun(Build.java:163)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:490)*14:18:45* at hudson.model.Run.execute(Run.java:1735)*14:18:45* at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)*14:18:45* at hudson.model.ResourceController.execute(ResourceController.java:97)*14:18:45* at hudson.model.Executor.run(Executor.java:405)*14:18:45* Build step 'Execute system Groovy script' marked build as failure {code} Issues: # the 'field java.io.File text' was not offered in /scriptApproval # after being added manually in xml it still failing with the same error (though i can see it in 'Signatures already approved') # Permissive security plugin doesn't help So, we ended up with completely broken builds without any fallback options. Job Configuration Problematic step: Execute system Groovy script + Groovy script file Code: {code} final File tmp = File.createTempFile(...) tmp.text = build.project.workspace.child('somefile').readToString() {code} |
New:
We have rather complex build scripts in groovy to deal. After upgrade to 2.60.1 they start fail with: {code} *14:18:45* ERROR: Build step failed with exception*14:18:45* org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: unclassified field java.io.File text*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.unclassifiedField(SandboxInterceptor.java:367)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onSetProperty(SandboxInterceptor.java:217)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$5.call(Checker.java:297)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker.checkedSetProperty(Checker.java:294)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$checkedSetProperty$2.callStatic(Unknown Source)*14:18:45* at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallStatic(CallSiteArray.java:56)*14:18:45* at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callStatic(AbstractCallSite.java:194)*14:18:45* at Script1.run(Script1.groovy:11)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.run(GroovySandbox.java:141)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:165)*14:18:45* at hudson.plugins.groovy.SystemGroovy.run(SystemGroovy.java:95)*14:18:45* at hudson.plugins.groovy.SystemGroovy.perform(SystemGroovy.java:59)*14:18:45* at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:735)*14:18:45* at hudson.model.Build$BuildExecution.build(Build.java:206)*14:18:45* at hudson.model.Build$BuildExecution.doRun(Build.java:163)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:490)*14:18:45* at hudson.model.Run.execute(Run.java:1735)*14:18:45* at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)*14:18:45* at hudson.model.ResourceController.execute(ResourceController.java:97)*14:18:45* at hudson.model.Executor.run(Executor.java:405)*14:18:45* Build step 'Execute system Groovy script' marked build as failure {code} Issues # the 'field java.io.File text' was not offered in /scriptApproval # after being added manually in xml it still failing with the same error (though i can see it in 'Signatures already approved') # Permissive security plugin doesn't help So, we ended up with completely broken builds without any fallback options. Job Configuration Problematic step: Execute system Groovy script + Groovy script file Code: {code} final File tmp = File.createTempFile(...) tmp.text = build.project.workspace.child('somefile').readToString() {code} |
| Description |
Original:
We have rather complex build scripts in groovy to deal. After upgrade to 2.60.1 they start fail with: {code} *14:18:45* ERROR: Build step failed with exception*14:18:45* org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: unclassified field java.io.File text*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.unclassifiedField(SandboxInterceptor.java:367)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onSetProperty(SandboxInterceptor.java:217)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$5.call(Checker.java:297)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker.checkedSetProperty(Checker.java:294)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$checkedSetProperty$2.callStatic(Unknown Source)*14:18:45* at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallStatic(CallSiteArray.java:56)*14:18:45* at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callStatic(AbstractCallSite.java:194)*14:18:45* at Script1.run(Script1.groovy:11)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.run(GroovySandbox.java:141)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:165)*14:18:45* at hudson.plugins.groovy.SystemGroovy.run(SystemGroovy.java:95)*14:18:45* at hudson.plugins.groovy.SystemGroovy.perform(SystemGroovy.java:59)*14:18:45* at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:735)*14:18:45* at hudson.model.Build$BuildExecution.build(Build.java:206)*14:18:45* at hudson.model.Build$BuildExecution.doRun(Build.java:163)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:490)*14:18:45* at hudson.model.Run.execute(Run.java:1735)*14:18:45* at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)*14:18:45* at hudson.model.ResourceController.execute(ResourceController.java:97)*14:18:45* at hudson.model.Executor.run(Executor.java:405)*14:18:45* Build step 'Execute system Groovy script' marked build as failure {code} Issues # the 'field java.io.File text' was not offered in /scriptApproval # after being added manually in xml it still failing with the same error (though i can see it in 'Signatures already approved') # Permissive security plugin doesn't help So, we ended up with completely broken builds without any fallback options. Job Configuration Problematic step: Execute system Groovy script + Groovy script file Code: {code} final File tmp = File.createTempFile(...) tmp.text = build.project.workspace.child('somefile').readToString() {code} |
New:
We have rather complex build scripts in groovy to deal. After upgrade to 2.60.1 they start fail with: {code} *14:18:45* ERROR: Build step failed with exception*14:18:45* org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: unclassified field java.io.File text*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.unclassifiedField(SandboxInterceptor.java:367)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onSetProperty(SandboxInterceptor.java:217)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$5.call(Checker.java:297)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker.checkedSetProperty(Checker.java:294)*14:18:45* at org.kohsuke.groovy.sandbox.impl.Checker$checkedSetProperty$2.callStatic(Unknown Source)*14:18:45* at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallStatic(CallSiteArray.java:56)*14:18:45* at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callStatic(AbstractCallSite.java:194)*14:18:45* at Script1.run(Script1.groovy:11)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.run(GroovySandbox.java:141)*14:18:45* at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:165)*14:18:45* at hudson.plugins.groovy.SystemGroovy.run(SystemGroovy.java:95)*14:18:45* at hudson.plugins.groovy.SystemGroovy.perform(SystemGroovy.java:59)*14:18:45* at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:735)*14:18:45* at hudson.model.Build$BuildExecution.build(Build.java:206)*14:18:45* at hudson.model.Build$BuildExecution.doRun(Build.java:163)*14:18:45* at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:490)*14:18:45* at hudson.model.Run.execute(Run.java:1735)*14:18:45* at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)*14:18:45* at hudson.model.ResourceController.execute(ResourceController.java:97)*14:18:45* at hudson.model.Executor.run(Executor.java:405)*14:18:45* Build step 'Execute system Groovy script' marked build as failure {code} Issues # the 'field java.io.File text' was not offered in /scriptApproval # after being added manually in xml it still failing with the same error (though i can see it in 'Signatures already approved') # Permissive security plugin doesn't help So, we ended up with completely broken builds without any fallback options. Job Configuration Problematic step: Execute system Groovy script + Groovy script file Code: {code} final File tmp = File.createTempFile(...) tmp.text = build.project.workspace.child('somefile').readToString() {code} |
| Remote Link | New: This issue links to "PR 131 (Web Link)" [ 17236 ] |
| Summary | Original: Groovy build script (file) rejected by Script Security | New: unclassified field java.io.File text |
Wojciech Duda
added a comment - jglick can this approach be changed? I was trying to use a pretty convenient
for(String fileName : bundleFileNames) { File k = new File(fileName) k.text = k.text.replaceAll("__cache_i18n_hash__", fullI18nHash) }
to patch JavaScript files, but I get the same error. I had to switch to using sed on the command line to achieve the same. Or maybe I am just too inexperienced to understand what "actual methods defined in the Java Platform" means and how to achieve the same doing that? Can you point me to an example? Google searches have left me empty-handed.
Wojciech Duda
added a comment - jglick can this approach be changed? I was trying to use a pretty convenient
for ( String fileName : bundleFileNames) {
File k = new File(fileName)
k.text = k.text.replaceAll( "__cache_i18n_hash__" , fullI18nHash)
}
to patch JavaScript files, but I get the same error. I had to switch to using sed on the command line to achieve the same. Or maybe I am just too inexperienced to understand what "actual methods defined in the Java Platform" means and how to achieve the same doing that? Can you point me to an example? Google searches have left me empty-handed. wduda please use the users’ list for help. JIRA is for reporting confirmed bugs and tracking their fixes.
Hello everyone.
Our team is constantly faced with the same difficulties when using ScriptApprovals.
So, there are two possible solutions to avoid "unclassified" errors, am I right?:
1)Modify methods that produce "unclassified" signatures
2) Or fully disable script security plugin (in case declarative pipelines are used - https://issues.jenkins-ci.org/browse/JENKINS-53700)
But what if any of the suggested methods are not applicable for our goals? Still we can't refuse using VCS for our pipelines.
Is it possible to manually classified signature as not dangerous? Cause I have a big doubt that after running a build the newly appeared signature would match the one already approved due to different types "unclassified" vs "classified"?
unclassified errors do not indicate that some signature is being rejected. They indicate that Jenkins cannot figure out what signature you were even trying to call. In this case you were trying to use this GDK method which for reasons TBD was not recognized. (Normally DefaultGroovyMethods is supported.) Possibly a dupe of one of the other bugs in this plugin.
The workaround is the usual one: use actual methods defined in the Java Platform.
(In this case you were trying to do local file operations, which are never going to be supported in sandbox mode since they are inherently security holes. You must use whole-script approval, or stop trying to use local files.)