I can confirm that this bug is in script-security-plugin v.1.26 as well as 1.29.1 running on Jenkins v. 1.651.3.
Code:
def PARAM = "param"
build.addAction(new ParametersAction(
new StringParameterValue('PARAM', PARAM)
));
as well as:
build.addAction(new ParametersAction(
new StringParameterValue("param1", param1),
new StringParameterValue("param2", param2),
));
yields following error:
ERROR: Build step failed with exception
java.lang.IllegalArgumentException
: array element type mismatch
at java.lang.reflect.Array.set(Native Method)
at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovyCallSiteSelector.parametersForVarargs(GroovyCallSiteSelector.java:102)
at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovyCallSiteSelector.matches(GroovyCallSiteSelector.java:49)
at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovyCallSiteSelector.constructor(GroovyCallSiteSelector.java:162)
at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onNewInstance(SandboxInterceptor.java:124)
at org.kohsuke.groovy.sandbox.impl.Checker$3.call(Checker.java:191)
at org.kohsuke.groovy.sandbox.impl.Checker.checkedConstructor(Checker.java:188)
at org.kohsuke.groovy.sandbox.impl.Checker$checkedConstructor.callStatic(Unknown Source)
at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallStatic(CallSiteArray.java:50)
at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callStatic(AbstractCallSite.java:157)
at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callStatic(AbstractCallSite.java:169)
at Script1.run(Script1.groovy:48)
at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.run(GroovySandbox.java:141)
at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:163)
at hudson.plugins.groovy.SystemGroovy.run(SystemGroovy.java:95)
at hudson.plugins.groovy.SystemGroovy.perform(SystemGroovy.java:59)
at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:782)
at hudson.maven.MavenModuleSetBuild$MavenModuleSetBuildExecution.build(MavenModuleSetBuild.java:945)
at hudson.maven.MavenModuleSetBuild$MavenModuleSetBuildExecution.doRun(MavenModuleSetBuild.java:683)
at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:534)
at hudson.model.Run.execute(Run.java:1738)
at hudson.maven.MavenModuleSetBuild.run(MavenModuleSetBuild.java:543)
at hudson.model.ResourceController.execute(ResourceController.java:98)
at hudson.model.Executor.run(Executor.java:410)
Build step 'Execute system Groovy script' marked build as failure
Workaround
I am attempting to overcome this issue by calling the only constructor that is not overloaded – the two parameter ParametersAction(List<ParameterValue> parameters, Collection<String> additionalSafeParameters) constructor.
ParameterValue[] params = [
new StringParameterValue("param1", param1),
new StringParameterValue("param2", param2),
]
String [] safeParams = []
build.addAction (new ParametersAction(params, safeParams));
I think that this is a severe issue for all of the Jenkins users that use Groovy scripting.
Hell, this usage is even written in the first example on the official jenkins-groovy-plugin page.
PR up at https://github.com/jenkinsci/script-security-plugin/pull/156