Loading...

This issue is archived. You can view it, but you can't modify it. Learn more

XML

Word

Printable

Type: Epic
Resolution: Fixed
Priority: Critical
Component/s: core, jenkins-test-harness
Labels:

Epic Name:
JEP-200: Switch Remoting/XStream blacklist to a whitelist

Currently Remoting and XStream2 share a blacklist of classes thought to be dangerous to deserialize, due to historically reported remote code execution attacks. We should instead switch to a whitelist, plus some categorical exemptions.

is blocked by

JENKINS-53613 Plugin affected by JEP-200

Open

JENKINS-53638 Maven Plugin Affected by JEP-200

Closed

is related to

JENKINS-49237 CPPNCSS Plugin fails with "WARNING: java.util.Calendar in JRE might be dangerous,"

Resolved

JENKINS-48963 UnsupportedOperationException: Refusing to marshal com.sonymobile.tools.gerrit.gerritevents.watchdog.WatchTimeExceptionData for security reasons

Resolved

JENKINS-49089 UnsupportedOperationException: Refusing to marshal org.apache.maven.artifact.versioning.DefaultArtifactVersion for security reasons

Resolved

JENKINS-41751 Groovy PowerAssertions don't show a useful message when being CPS transformed

Resolved

JENKINS-49016 Android-lint plugin affected by JEP in 2.102

Resolved

JENKINS-49176 SimpleDateFormat is not whitelisted - JEP-200

Resolved

JENKINS-49573 Matrix Configuration Parameter Plugin is affected by JEP-200

Closed

JENKINS-50566 Google Compute Engine Plugin JEP-200 Class rejected

Closed

JENKINS-50460 Builds marked as failed - Dr Memory plugin (JEP-200)

Closed

JENKINS-49175 Job DSL Plugin violates whitelist

Closed

JENKINS-49699 Doktor plugin affected by JEP-200

Closed

relates to

JENKINS-48734 JEP-200 - Make PCT usable for testing plugin compatibility with unreleased Jenkins Cores

Resolved

JENKINS-43875 Cleanup following SECURITY-429

Resolved

JENKINS-57796 Checkmarx affected by JEP-200

Open

JENKINS-49025 SecurityException: Rejected: java.lang.String$CaseInsensitiveComparator

Resolved

JENKINS-49130 Sonar Quality Gates run fails after upgrade to Jenkins 2.102/2.103

Resolved

JENKINS-48965 Refusing to marshal java.util.Collections$SynchronizedRandomAccessList for security reasons

Resolved

JENKINS-49586 JDepend plugin classes not in JEP-200 whitelist

Resolved

JENKINS-51331 AuditTrail plugin incompatible with JEP-200

Resolved

JENKINS-47158 Warnings about workflow/*-parallel-synthetic.xml serializing WorkflowRun objects

Closed

links to

CloudBees Internal OSS-2508

cloudbees-folder PR 116

copyartifact PR 97

credentials PR 96

crx-content-package-deployer PR 8

dependency-check PR 20

dockerhub-notification PR 16

git-client PR 290

jenkins-test-harness PR 81

job-dsl PR 1092

kubernetes-pipeline PR 66

lib-jenkins-maven-embedder PR 15

monitoring PR 6

nexus-platform PR 16

parameterized-trigger PR 118

pipeline-build-step PR 17

priority-sorter PR 42

project-description-setter PR 2

publish-over PR 8

remoting PR 208

ruby-runtime PR 5

saltstack PR 116

Wiki Page with the list of affected plugins

workflow-cps PR 190

workflow-support PR 50

xtrigger-lib PR 9

(8 is related to, 9 relates to, 28 links to)

Assignee:: Jesse Glick
Reporter:: Jesse Glick

Created:: 2017-10-30 18:02
Updated:: 2025-11-25 17:18
Resolved:: 2018-01-12 22:42
Archived:: 2025-11-25 17:18