[JENKINS-48963] UnsupportedOperationException: Refusing to marshal com.sonymobile.tools.gerrit.gerritevents.watchdog.WatchTimeExceptionData for security reasons - Jenkins Jira

XML

Word

Printable

Details

Type: Bug
Status: Resolved (View Workflow)
Priority: Major
Resolution: Duplicate
Component/s: gerrit-trigger-plugin
Labels:
- JEP-200

Similar Issues:

Show

Description

Caused by: java.lang.UnsupportedOperationException: Refusing to marshal com.sonymobile.tools.gerrit.gerritevents.watchdog.WatchTimeExceptionData for security reasons; see https://jenkins.io/redirect/class-filter/
   at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:530)
   at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
   at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
   at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
   at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
   at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)

So following what is written on https://jenkins.io/redirect/class-filter/ I am reporting this issue. Note that after doing save a few times, little by little it saved all the needed values even though this exception continues to occur.

Attachments

- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

Screenshot from 2018-01-16 16-15-10.png
9 kB
2018-01-16 15:15

Issue Links

duplicates

JENKINS-48943 Gerrit Trigger Plugin is affected by JEP-200 in Jenkins 2.102+

Resolved

is related to

JENKINS-47736 JEP-200: Switch Remoting/XStream blacklist to a whitelist

Resolved

JENKINS-48943 Gerrit Trigger Plugin is affected by JEP-200 in Jenkins 2.102+

Resolved

Activity

Ascending order - Click to sort in descending order

Marc des Garets created issue - 2018-01-16 14:22

Marc des Garets made changes - 2018-01-16 14:23

Field	Original Value	New Value
Link		This issue is related to ~~JENKINS-47736~~ [ ~~JENKINS-47736~~ ]

Marc des Garets made changes - 2018-01-16 14:26

Description

After upgrading jenkins and updating the gerrit trigger plugin, it couldn't read the gerrit-trigger.xml file so I deleted it. Now when I try to add a new server under gerrit trigger or try to edit existing server, when I save it throws an exception:

Caused by: java.lang.UnsupportedOperationException: Refusing to marshal com.sonymobile.tools.gerrit.gerritevents.watchdog.WatchTimeExceptionData for security reasons; see https://jenkins.io/redirect/class-filter/
   at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:530)
   at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
   at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
   at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
   at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
   at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)

So following what is written on [https://jenkins.io/redirect/class-filter/] I am reporting this issue. Is there a way to bypass this for the time being?

After upgrading jenkins and updating the gerrit trigger plugin, it couldn't read the gerrit-trigger.xml file so I deleted it. Now when I try to add a new server under gerrit trigger or try to edit existing server, when I save it throws an exception:

Caused by: java.lang.UnsupportedOperationException: Refusing to marshal com.sonymobile.tools.gerrit.gerritevents.watchdog.WatchTimeExceptionData for security reasons; see [https://jenkins.io/redirect/class-filter/]
    at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:530)
    at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
    at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
    at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
    at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
    at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)

So following what is written on [https://jenkins.io/redirect/class-filter/] I am reporting this issue. Note that after doing save a few times, little by little it saved all the needed values.

Marc des Garets made changes - 2018-01-16 14:26

Description

After upgrading jenkins and updating the gerrit trigger plugin, it couldn't read the gerrit-trigger.xml file so I deleted it. Now when I try to add a new server under gerrit trigger or try to edit existing server, when I save it throws an exception:

Caused by: java.lang.UnsupportedOperationException: Refusing to marshal com.sonymobile.tools.gerrit.gerritevents.watchdog.WatchTimeExceptionData for security reasons; see [https://jenkins.io/redirect/class-filter/]
    at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:530)
    at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
    at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
    at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
    at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
    at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)

So following what is written on [https://jenkins.io/redirect/class-filter/] I am reporting this issue. Note that after doing save a few times, little by little it saved all the needed values.

After upgrading jenkins and updating the gerrit trigger plugin, it couldn't read the gerrit-trigger.xml file so I deleted it. Now when I try to add a new server under gerrit trigger or try to edit existing server, when I save it throws an exception:

Caused by: java.lang.UnsupportedOperationException: Refusing to marshal com.sonymobile.tools.gerrit.gerritevents.watchdog.WatchTimeExceptionData for security reasons; see [https://jenkins.io/redirect/class-filter/]
    at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:530)
    at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
    at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
    at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
    at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
    at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)

So following what is written on [https://jenkins.io/redirect/class-filter/] I am reporting this issue. Note that after doing save a few times, little by little it saved all the needed values even though this exception continues to occur.

Oleg Nenashev added a comment - 2018-01-16 15:11

ttux Are you sure you are using Gerrit Trigger 2.27.2? Full Stacktrace would be helpful.

Oleg Nenashev added a comment - 2018-01-16 15:11 ttux Are you sure you are using Gerrit Trigger 2.27.2? Full Stacktrace would be helpful.

Oleg Nenashev made changes - 2018-01-16 15:11

Link

This issue is related to ~~JENKINS-48943~~ [ ~~JENKINS-48943~~ ]

Oleg Nenashev made changes - 2018-01-16 15:11

Assignee

lucamilanesio [ lucamilanesio ]

Oleg Nenashev [ oleg_nenashev ]

Oleg Nenashev added a comment - 2018-01-16 15:13

i confirm that the class is in the patched library: https://github.com/sonyxperiadev/gerrit-events/blob/master/src/main/java/com/sonymobile/tools/gerrit/gerritevents/watchdog/WatchTimeExceptionData.java
If the plugin is up to date, there is a chance it conflicts with another lib with PluginFirstClassloader

Oleg Nenashev added a comment - 2018-01-16 15:13 i confirm that the class is in the patched library: https://github.com/sonyxperiadev/gerrit-events/blob/master/src/main/java/com/sonymobile/tools/gerrit/gerritevents/watchdog/WatchTimeExceptionData.java If the plugin is up to date, there is a chance it conflicts with another lib with PluginFirstClassloader

Marc des Garets made changes - 2018-01-16 15:15

Attachment

Screenshot from 2018-01-16 16-15-10.png [ 41137 ]

Oleg Nenashev added a comment - 2018-01-16 15:17

ttux the screenshot says you're using 2.27.1, not 2.27.2

Oleg Nenashev added a comment - 2018-01-16 15:17 ttux the screenshot says you're using 2.27.1, not 2.27.2

Marc des Garets added a comment - 2018-01-16 15:20

But I just saw in the logs:

WARNING: com.sonymobile.tools.gerrit.gerritevents.watchdog.WatchTimeExceptionData in file:/home/jenkins/.jenkins/plugins/gerrit-trigger/WEB-INF/lib/gerrit-events-2.11.1.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/

I also can see others:

java.io.IOException: java.lang.RuntimeException: Failed to serialize hudson.model.Actionable#actions for class hudson.model.FreeStyleBuild
        at hudson.XmlFile.write(XmlFile.java:201)
        at hudson.model.Run.save(Run.java:1923)
        at com.sonyericsson.hudson.plugins.gerrit.trigger.gerritnotifier.model.BuildMemory.updateTriggerContext(BuildMemory.java:291)
        at com.sonyericsson.hudson.plugins.gerrit.trigger.gerritnotifier.ToGerritRunListener.updateTriggerContexts(ToGerritRunListener.java:277)
        at com.sonyericsson.hudson.plugins.gerrit.trigger.gerritnotifier.ToGerritRunListener.onCompleted(ToGerritRunListener.java:161)
        at hudson.model.listeners.RunListener.fireCompleted(RunListener.java:211)
        at hudson.model.Run.execute(Run.java:1772)
        at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
        at hudson.model.ResourceController.execute(ResourceController.java:97)
        at hudson.model.Executor.run(Executor.java:429)

...

Caused by: java.lang.UnsupportedOperationException: Refusing to marshal com.sonymobile.tools.gerrit.gerritevents.dto.attr.Provider for security reasons; see https://jenkins.io/redirect/class-filter/
        at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:530)
        at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
        at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
        at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
        at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
        at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)
        ... 63 more

Marc des Garets added a comment - 2018-01-16 15:20 But I just saw in the logs: WARNING: com.sonymobile.tools.gerrit.gerritevents.watchdog.WatchTimeExceptionData in file:/home/jenkins/.jenkins/plugins/gerrit-trigger/WEB-INF/lib/gerrit-events-2.11.1.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/ I also can see others: java.io.IOException: java.lang.RuntimeException: Failed to serialize hudson.model.Actionable#actions for class hudson.model.FreeStyleBuild at hudson.XmlFile.write(XmlFile.java:201) at hudson.model.Run.save(Run.java:1923) at com.sonyericsson.hudson.plugins.gerrit.trigger.gerritnotifier.model.BuildMemory.updateTriggerContext(BuildMemory.java:291) at com.sonyericsson.hudson.plugins.gerrit.trigger.gerritnotifier.ToGerritRunListener.updateTriggerContexts(ToGerritRunListener.java:277) at com.sonyericsson.hudson.plugins.gerrit.trigger.gerritnotifier.ToGerritRunListener.onCompleted(ToGerritRunListener.java:161) at hudson.model.listeners.RunListener.fireCompleted(RunListener.java:211) at hudson.model.Run.execute(Run.java:1772) at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43) at hudson.model.ResourceController.execute(ResourceController.java:97) at hudson.model.Executor.run(Executor.java:429) ... Caused by: java.lang.UnsupportedOperationException: Refusing to marshal com.sonymobile.tools.gerrit.gerritevents.dto.attr.Provider for security reasons; see https://jenkins.io/redirect/class-filter/ at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:530) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84) at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265) at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252) ... 63 more

Oleg Nenashev added a comment - 2018-01-16 15:27

"gerrit-events" library is not being used in other plugins within jenkinsci organization.
If you see Gerrit Events 2.11.1 in the log, it means that you HAVE NOT upgraded to Gerrit Trigger Plugin 2.27.2. Please do so. Last screenshot does not show the version at all

Oleg Nenashev added a comment - 2018-01-16 15:27 "gerrit-events" library is not being used in other plugins within jenkinsci organization. If you see Gerrit Events 2.11.1 in the log, it means that you HAVE NOT upgraded to Gerrit Trigger Plugin 2.27. 2 . Please do so. Last screenshot does not show the version at all

Marc des Garets added a comment - 2018-01-16 15:29

Good point, so when 2.72.2 is being picked up by jenkins and I can upgrade then this issue will be gone?

Marc des Garets added a comment - 2018-01-16 15:29 Good point, so when 2.72.2 is being picked up by jenkins and I can upgrade then this issue will be gone?

Marc des Garets added a comment - 2018-01-16 15:30

Ok sorry, I didn't see https://issues.jenkins-ci.org/browse/JENKINS-48943 so you can close this issue and sorry for wasting your time.

Marc des Garets added a comment - 2018-01-16 15:30 Ok sorry, I didn't see https://issues.jenkins-ci.org/browse/JENKINS-48943 so you can close this issue and sorry for wasting your time.

Oleg Nenashev added a comment - 2018-01-16 15:31

np, it happens

Oleg Nenashev added a comment - 2018-01-16 15:31 np, it happens

Oleg Nenashev made changes - 2018-01-16 15:32

Link

This issue duplicates ~~JENKINS-48943~~ [ ~~JENKINS-48943~~ ]

Oleg Nenashev made changes - 2018-01-16 15:32

Resolution		Duplicate [ 3 ]
Status	Open [ 1 ]	Resolved [ 5 ]

Luca Domenico Milanesio made changes - 2018-10-14 17:15

Component/s

gerrit-code-review-plugin [ 23427 ]

Luca Domenico Milanesio added a comment - 2018-10-14 17:16

oleg_nenashev I've removed the Gerrit Code Review plugin, this issue is specific to the Gerrit Trigger.

Luca Domenico Milanesio added a comment - 2018-10-14 17:16 oleg_nenashev I've removed the Gerrit Code Review plugin, this issue is specific to the Gerrit Trigger.

People

Assignee:: Oleg Nenashev

Reporter:: Marc des Garets

Votes:: 0 Vote for this issue

Watchers:: 4 Start watching this issue

Dates

Created:: 2018-01-16 14:22

Updated:: 2018-10-14 17:16

Resolved:: 2018-01-16 15:32