[JENKINS-45629] CPS-transformed field initialization including operations causes NPE in transformation

Type: Bug
Resolution: Fixed
Priority: Critical
Component/s: script-security-plugin
Labels:
- cloudbees-internal-pipeline
Environment:
workflow-cps 2.36.1
script-security 1.29.1
core 2.60.1

Similar Issues:
Powered by SuggestiMate

Show

So now code like this:

class C {
  String f = "banana"
  String g = "other " + f
}

...will cause a NullPointerException in compilation/transformation - see below for the stacktrace.

The root cause is that groovy-cps:1.17 started calling SandboxTransfromer.VisitorImpl.visitField to sandbox class fields, but there's no varScope set when those fields are visited, so ScopeTrackingClassCodeExpressionTransformer.isLocalVariable blows up.

[Bitbucket] Notifying commit build result
[Bitbucket] Build result notified
java.lang.NullPointerException: Cannot invoke method has() on null object
at org.codehaus.groovy.runtime.NullObject.invokeMethod(NullObject.java:91)
at org.codehaus.groovy.runtime.callsite.PogoMetaClassSite.call(PogoMetaClassSite.java:48)
at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:48)
at org.codehaus.groovy.runtime.callsite.NullCallSite.call(NullCallSite.java:35)
at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:48)
at org.codehaus.groovy.runtime.callsite.PojoMetaMethodSite.call(PojoMetaMethodSite.java:58)
at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:125)
at org.kohsuke.groovy.sandbox.ScopeTrackingClassCodeExpressionTransformer.isLocalVariable(ScopeTrackingClassCodeExpressionTransformer.groovy:35)
at org.kohsuke.groovy.sandbox.ScopeTrackingClassCodeExpressionTransformer$isLocalVariable$0.callCurrent(Unknown Source)
at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.innerTransform(SandboxTransformer.groovy:288)
at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.this$6$innerTransform(SandboxTransformer.groovy)
at sun.reflect.GeneratedMethodAccessor811.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite$PogoCachedMethodSiteNoUnwrapNoCoerce.invoke(PogoMetaMethodSite.java:210)
at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:59)
at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52)
at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:64)
at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:166)
at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.transform(SandboxTransformer.groovy:188)
at org.codehaus.groovy.ast.expr.ExpressionTransformer$transform.callCurrent(Unknown Source)
at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52)
at org.codehaus.groovy.ast.expr.ExpressionTransformer$transform.callCurrent(Unknown Source)
at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.innerTransform(SandboxTransformer.groovy:418)
at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.this$6$innerTransform(SandboxTransformer.groovy)
at sun.reflect.GeneratedMethodAccessor811.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite$PogoCachedMethodSiteNoUnwrapNoCoerce.invoke(PogoMetaMethodSite.java:210)
at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:59)
at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52)
at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:64)
at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:166)
at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.transform(SandboxTransformer.groovy:188)
at org.codehaus.groovy.ast.ClassCodeExpressionTransformer.visitField(ClassCodeExpressionTransformer.java:68)
at com.cloudbees.groovy.cps.SandboxCpsTransformer.visitNontransformedField(SandboxCpsTransformer.java:46)
at com.cloudbees.groovy.cps.CpsTransformer.call(CpsTransformer.java:132)
at com.cloudbees.groovy.cps.SandboxCpsTransformer.call(SandboxCpsTransformer.java:26)
at org.codehaus.groovy.control.CompilationUnit.applyToPrimaryClassNodes(CompilationUnit.java:1065)
Caused: BUG! exception in phase 'canonicalization' in source unit 'file:.../src/C.groovy' unexpected NullpointerException
at org.codehaus.groovy.control.CompilationUnit.applyToPrimaryClassNodes(CompilationUnit.java:1070)
at org.codehaus.groovy.control.CompilationUnit.doPhaseOperation(CompilationUnit.java:603)
at org.codehaus.groovy.control.CompilationUnit.processPhaseOperations(CompilationUnit.java:581)
at org.codehaus.groovy.control.CompilationUnit.compile(CompilationUnit.java:558)
at groovy.lang.GroovyClassLoader.doParseClass(GroovyClassLoader.java:298)
at groovy.lang.GroovyClassLoader.parseClass(GroovyClassLoader.java:268)
at groovy.lang.GroovyShell.parseClass(GroovyShell.java:688)
at groovy.lang.GroovyShell.parse(GroovyShell.java:700)
at org.jenkinsci.plugins.workflow.cps.CpsGroovyShell.doParse(CpsGroovyShell.java:129)
at org.jenkinsci.plugins.workflow.cps.CpsGroovyShell.reparse(CpsGroovyShell.java:123)
at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.parseScript(CpsFlowExecution.java:516)
at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.start(CpsFlowExecution.java:479)
at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:268)
at hudson.model.ResourceController.execute(ResourceController.java:97)
at hudson.model.Executor.run(Executor.java:405)
Finished: FAILURE

is duplicated by

JENKINS-45583 Initializing member variables cannot reference each other

Resolved

relates to

JENKINS-34599 Static initializers not allowed to set final fields

Resolved

links to

groovy-sandbox PR #33

script-security PR 132

workflow-cps PR 157

T.J. Hawkins created issue - 2017-07-18 20:18

Andrew Bayer made changes - 2017-07-18 20:19

Assignee

New: Andrew Bayer [ abayer ]

Andrew Bayer made changes - 2017-07-18 20:19

Status

Original: Open [ 1 ]

New: In Progress [ 3 ]

Andrew Bayer made changes - 2017-07-18 20:24

Description	Original: Recently upgraded to 2.60.1.1 and now getting errors as such. {noformat} [Bitbucket] Notifying commit build result [Bitbucket] Build result notified java.lang.NullPointerException: Cannot invoke method has() on null object at org.codehaus.groovy.runtime.NullObject.invokeMethod(NullObject.java:91) at org.codehaus.groovy.runtime.callsite.PogoMetaClassSite.call(PogoMetaClassSite.java:48) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:48) at org.codehaus.groovy.runtime.callsite.NullCallSite.call(NullCallSite.java:35) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:48) at org.codehaus.groovy.runtime.callsite.PojoMetaMethodSite.call(PojoMetaMethodSite.java:58) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:125) at org.kohsuke.groovy.sandbox.ScopeTrackingClassCodeExpressionTransformer.isLocalVariable(ScopeTrackingClassCodeExpressionTransformer.groovy:35) at org.kohsuke.groovy.sandbox.ScopeTrackingClassCodeExpressionTransformer$isLocalVariable$0.callCurrent(Unknown Source) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.innerTransform(SandboxTransformer.groovy:288) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.this$6$innerTransform(SandboxTransformer.groovy) at sun.reflect.GeneratedMethodAccessor811.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite$PogoCachedMethodSiteNoUnwrapNoCoerce.invoke(PogoMetaMethodSite.java:210) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:59) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:64) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:166) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.transform(SandboxTransformer.groovy:188) at org.codehaus.groovy.ast.expr.ExpressionTransformer$transform.callCurrent(Unknown Source) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52) at org.codehaus.groovy.ast.expr.ExpressionTransformer$transform.callCurrent(Unknown Source) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.innerTransform(SandboxTransformer.groovy:418) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.this$6$innerTransform(SandboxTransformer.groovy) at sun.reflect.GeneratedMethodAccessor811.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite$PogoCachedMethodSiteNoUnwrapNoCoerce.invoke(PogoMetaMethodSite.java:210) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:59) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:64) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:166) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.transform(SandboxTransformer.groovy:188) at org.codehaus.groovy.ast.ClassCodeExpressionTransformer.visitField(ClassCodeExpressionTransformer.java:68) at com.cloudbees.groovy.cps.SandboxCpsTransformer.visitNontransformedField(SandboxCpsTransformer.java:46) at com.cloudbees.groovy.cps.CpsTransformer.call(CpsTransformer.java:132) at com.cloudbees.groovy.cps.SandboxCpsTransformer.call(SandboxCpsTransformer.java:26) at org.codehaus.groovy.control.CompilationUnit.applyToPrimaryClassNodes(CompilationUnit.java:1065) Caused: BUG! exception in phase 'canonicalization' in source unit 'file:OpenShiftDeployTarget.groovy' unexpected NullpointerException at org.codehaus.groovy.control.CompilationUnit.applyToPrimaryClassNodes(CompilationUnit.java:1070) at org.codehaus.groovy.control.CompilationUnit.doPhaseOperation(CompilationUnit.java:603) at org.codehaus.groovy.control.CompilationUnit.processPhaseOperations(CompilationUnit.java:581) at org.codehaus.groovy.control.CompilationUnit.compile(CompilationUnit.java:558) at groovy.lang.GroovyClassLoader.doParseClass(GroovyClassLoader.java:298) at groovy.lang.GroovyClassLoader.parseClass(GroovyClassLoader.java:268) at groovy.lang.GroovyShell.parseClass(GroovyShell.java:688) at groovy.lang.GroovyShell.parse(GroovyShell.java:700) at org.jenkinsci.plugins.workflow.cps.CpsGroovyShell.doParse(CpsGroovyShell.java:129) at org.jenkinsci.plugins.workflow.cps.CpsGroovyShell.reparse(CpsGroovyShell.java:123) at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.parseScript(CpsFlowExecution.java:516) at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.start(CpsFlowExecution.java:479) at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:268) at hudson.model.ResourceController.execute(ResourceController.java:97) at hudson.model.Executor.run(Executor.java:405) Finished: FAILURE {noformat}	New: So now code like this: {code} class C { String f = "banana" String g = "other " + f } {code} ...will cause a {{NullPointerException}} in compilation/transformation - see below for the stacktrace. The root cause is that {{groovy-cps:1.17}} started calling {{SandboxTransfromer.VisitorImpl.visitField}} to sandbox class fields, but there's no {{varScope}} set when those fields are visited, so {{ScopeTrackingClassCodeExpressionTransformer.isLocalVariable}} blows up. {noformat} [Bitbucket] Notifying commit build result [Bitbucket] Build result notified java.lang.NullPointerException: Cannot invoke method has() on null object at org.codehaus.groovy.runtime.NullObject.invokeMethod(NullObject.java:91) at org.codehaus.groovy.runtime.callsite.PogoMetaClassSite.call(PogoMetaClassSite.java:48) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:48) at org.codehaus.groovy.runtime.callsite.NullCallSite.call(NullCallSite.java:35) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCall(CallSiteArray.java:48) at org.codehaus.groovy.runtime.callsite.PojoMetaMethodSite.call(PojoMetaMethodSite.java:58) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:125) at org.kohsuke.groovy.sandbox.ScopeTrackingClassCodeExpressionTransformer.isLocalVariable(ScopeTrackingClassCodeExpressionTransformer.groovy:35) at org.kohsuke.groovy.sandbox.ScopeTrackingClassCodeExpressionTransformer$isLocalVariable$0.callCurrent(Unknown Source) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.innerTransform(SandboxTransformer.groovy:288) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.this$6$innerTransform(SandboxTransformer.groovy) at sun.reflect.GeneratedMethodAccessor811.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite$PogoCachedMethodSiteNoUnwrapNoCoerce.invoke(PogoMetaMethodSite.java:210) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:59) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:64) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:166) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.transform(SandboxTransformer.groovy:188) at org.codehaus.groovy.ast.expr.ExpressionTransformer$transform.callCurrent(Unknown Source) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52) at org.codehaus.groovy.ast.expr.ExpressionTransformer$transform.callCurrent(Unknown Source) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.innerTransform(SandboxTransformer.groovy:418) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.this$6$innerTransform(SandboxTransformer.groovy) at sun.reflect.GeneratedMethodAccessor811.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite$PogoCachedMethodSiteNoUnwrapNoCoerce.invoke(PogoMetaMethodSite.java:210) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:59) at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallCurrent(CallSiteArray.java:52) at org.codehaus.groovy.runtime.callsite.PogoMetaMethodSite.callCurrent(PogoMetaMethodSite.java:64) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callCurrent(AbstractCallSite.java:166) at org.kohsuke.groovy.sandbox.SandboxTransformer$VisitorImpl.transform(SandboxTransformer.groovy:188) at org.codehaus.groovy.ast.ClassCodeExpressionTransformer.visitField(ClassCodeExpressionTransformer.java:68) at com.cloudbees.groovy.cps.SandboxCpsTransformer.visitNontransformedField(SandboxCpsTransformer.java:46) at com.cloudbees.groovy.cps.CpsTransformer.call(CpsTransformer.java:132) at com.cloudbees.groovy.cps.SandboxCpsTransformer.call(SandboxCpsTransformer.java:26) at org.codehaus.groovy.control.CompilationUnit.applyToPrimaryClassNodes(CompilationUnit.java:1065) Caused: BUG! exception in phase 'canonicalization' in source unit 'file:.../src/C.groovy' unexpected NullpointerException at org.codehaus.groovy.control.CompilationUnit.applyToPrimaryClassNodes(CompilationUnit.java:1070) at org.codehaus.groovy.control.CompilationUnit.doPhaseOperation(CompilationUnit.java:603) at org.codehaus.groovy.control.CompilationUnit.processPhaseOperations(CompilationUnit.java:581) at org.codehaus.groovy.control.CompilationUnit.compile(CompilationUnit.java:558) at groovy.lang.GroovyClassLoader.doParseClass(GroovyClassLoader.java:298) at groovy.lang.GroovyClassLoader.parseClass(GroovyClassLoader.java:268) at groovy.lang.GroovyShell.parseClass(GroovyShell.java:688) at groovy.lang.GroovyShell.parse(GroovyShell.java:700) at org.jenkinsci.plugins.workflow.cps.CpsGroovyShell.doParse(CpsGroovyShell.java:129) at org.jenkinsci.plugins.workflow.cps.CpsGroovyShell.reparse(CpsGroovyShell.java:123) at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.parseScript(CpsFlowExecution.java:516) at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.start(CpsFlowExecution.java:479) at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:268) at hudson.model.ResourceController.execute(ResourceController.java:97) at hudson.model.Executor.run(Executor.java:405) Finished: FAILURE {noformat}
Environment		New: workflow-cps 2.36.1 script-security 1.29.1 core 2.60.1
Summary	Original: BUG! exception in phase 'canonicalization' in source unit	New: CPS-transformed field initialization including operations causes NPE in transformation

Jesse Glick made changes - 2017-07-18 20:32

Link

New: This issue relates to ~~JENKINS-34599~~ [ ~~JENKINS-34599~~ ]

Jesse Glick made changes - 2017-07-18 20:32

Link

New: This issue relates to SECURITY-551 [ SECURITY-551 ]

Andrew Bayer made changes - 2017-07-18 20:35

Priority

Original: Minor [ 4 ]

New: Critical [ 2 ]

Andrew Bayer made changes - 2017-07-18 20:35

Labels

New: cloudbees-internal-pipeline

Andrew Bayer made changes - 2017-07-18 20:37

Status

Original: In Progress [ 3 ]

New: In Review [ 10005 ]

Andrew Bayer made changes - 2017-07-18 20:38

Remote Link

New: This issue links to "groovy-sandbox PR #33 (Web Link)" [ 17298 ]

Jesse Glick made changes - 2017-07-25 14:05

Assignee	Original: Andrew Bayer [ abayer ]	New: Jesse Glick [ jglick ]
Resolution		New: Fixed [ 1 ]
Status	Original: In Review [ 10005 ]	New: Resolved [ 5 ]

Assignee:: Jesse Glick

Reporter:: T.J. Hawkins

Votes:: 5 Vote for this issue

Watchers:: 8 Start watching this issue

Created:: 2017-07-18 20:18

Updated:: 2017-07-25 18:16

Resolved:: 2017-07-25 14:05

Jenkins

Details

Description

Attachments

Issue Links

Activity

People

Dates