[JENKINS-48991] Artifactory plugin affected by JEP in 2.102

Type: Bug
Resolution: Duplicate
Priority: Minor
Component/s: artifactory-plugin
Labels:
- JEP-200
Environment:
Jenkins Artifactory Plugin version: 2.14.0
Suse Enterprise Linux 12
Jenkins 2.102 (Windows Master - Linux Slave)

Similar Issues:
Powered by SuggestiMate

Show
Epic Link:
JEP-200: Switch Remoting/XStream blacklist to a whitelist

Pipeline build is failing after deploying artifact to Artifactory.

I have added JVM arg to both slave and master
-Dhudson.remoting.ClassFilter=org.jfrog.build.client.DeployDetails
Error from log:

java.lang.SecurityException: Rejected: org.jfrog.build.client.DeployDetails
	at hudson.remoting.ClassFilter.check(ClassFilter.java:75)
	at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:129)
	at java.io.ObjectInputStream.readNonProxyDesc(Unknown Source)
	at java.io.ObjectInputStream.readClassDesc(Unknown Source)
	at java.io.ObjectInputStream.readOrdinaryObject(Unknown Source)
	at java.io.ObjectInputStream.readObject0(Unknown Source)
	at java.io.ObjectInputStream.readObject(Unknown Source)
	at java.util.ArrayList.readObject(Unknown Source)
	at sun.reflect.GeneratedMethodAccessor123.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
	at java.lang.reflect.Method.invoke(Unknown Source)
	at java.io.ObjectStreamClass.invokeReadObject(Unknown Source)
	at java.io.ObjectInputStream.readSerialData(Unknown Source)
	at java.io.ObjectInputStream.readOrdinaryObject(Unknown Source)
	at java.io.ObjectInputStream.readObject0(Unknown Source)
	at java.io.ObjectInputStream.readObject(Unknown Source)
	at hudson.remoting.UserRequest.deserialize(UserRequest.java:277)
	at hudson.remoting.UserResponse.retrieve(UserRequest.java:310)
	at hudson.remoting.Channel.call(Channel.java:909)
	at hudson.FilePath.act(FilePath.java:998)
	at hudson.FilePath.act(FilePath.java:987)
	at org.jfrog.hudson.pipeline.types.buildInfo.BuildInfo.appendDeployableArtifacts(BuildInfo.java:159)
	at org.jfrog.hudson.pipeline.steps.ArtifactoryMavenBuild$Execution.run(ArtifactoryMavenBuild.java:112)
	at org.jfrog.hudson.pipeline.steps.ArtifactoryMavenBuild$Execution.run(ArtifactoryMavenBuild.java:61)
	at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47)
	at hudson.security.ACL.impersonate(ACL.java:274)
	at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44)
	at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
	at java.util.concurrent.FutureTask.run(Unknown Source)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
	at java.lang.Thread.run(Unknown Source)

duplicates

JENKINS-48983 Artifactory Plugin is affected by JEP-200 in Jenkins 2.102+

Resolved

is related to

JENKINS-48983 Artifactory Plugin is affected by JEP-200 in Jenkins 2.102+

Resolved

JENKINS-49000 Add common Guava collection classes to the core's whitelist

Resolved

relates to

JENKINS-67105 Upgrade to 2.320 gives Failed to deserialize response error.

Closed

links to

https://github.com/jenkinsci/artifactory-plugin/pull/30

Nicholas Tones created issue - 2018-01-17 10:35

Nicholas Tones made changes - 2018-01-17 10:35

Epic Link

New: ~~JENKINS-47736~~ [ 186227 ]

Nicholas Tones added a comment - 2018-01-17 10:37

Further to this on the master I am seeing the following errors reported for this pipeline build:

Jan 17, 2018 10:17:43 AM org.jenkinsci.plugins.workflow.graph.FlowNode persistSafe
WARNING: failed to save actions for FlowNode id=24
java.io.IOException: java.lang.RuntimeException: Failed to serialize org.jenkinsci.plugins.workflow.support.storage.SimpleXStreamFlowNodeStorage$Tag#actions for class org.jenkinsci.plugins.workflow.support.storage.SimpleXStreamFlowNodeStorage$Tag
at hudson.XmlFile.write(XmlFile.java:201)
at org.jenkinsci.plugins.workflow.support.storage.SimpleXStreamFlowNodeStorage.saveActions(SimpleXStreamFlowNodeStorage.java:111)
at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution$TimingFlowNodeStorage.saveActions(CpsFlowExecution.java:1490)
at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.saveActions(CpsFlowExecution.java:1014)
at org.jenkinsci.plugins.workflow.graph.FlowNode.save(FlowNode.java:446)
at org.jenkinsci.plugins.workflow.graph.FlowNode.persistSafe(FlowNode.java:452)
at org.jenkinsci.plugins.workflow.graph.FlowNode.access$100(FlowNode.java:61)
at org.jenkinsci.plugins.workflow.graph.FlowNode$1.add(FlowNode.java:411)
at org.jenkinsci.plugins.workflow.graph.FlowNode$1.add(FlowNode.java:401)
at java.util.AbstractList.add(Unknown Source)
at hudson.model.Actionable.addAction(Actionable.java:155)
at org.jenkinsci.plugins.workflow.cps.FlowHead.markIfFail(FlowHead.java:144)
at org.jenkinsci.plugins.workflow.cps.CpsStepContext$2.onSuccess(CpsStepContext.java:439)
at org.jenkinsci.plugins.workflow.cps.CpsStepContext$2.onSuccess(CpsStepContext.java:395)
at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution$4$1.run(CpsFlowExecution.java:746)
at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$1.run(CpsVmExecutorService.java:35)
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
at java.util.concurrent.FutureTask.run(Unknown Source)
at hudson.remoting.SingleLaneExecutorService$1.run(SingleLaneExecutorService.java:131)
at jenkins.util.ContextResettingExecutorService$1.run(ContextResettingExecutorService.java:28)
at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
at java.util.concurrent.FutureTask.run(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.RuntimeException: Failed to serialize org.jenkinsci.plugins.workflow.support.storage.SimpleXStreamFlowNodeStorage$Tag#actions for class org.jenkinsci.plugins.workflow.support.storage.SimpleXStreamFlowNodeStorage$Tag
at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256)
at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224)
at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138)
at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209)
at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43)
at com.thoughtworks.xstream.core.TreeMarshaller.start(TreeMarshaller.java:82)
at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.marshal(AbstractTreeMarshallingStrategy.java:37)
at com.thoughtworks.xstream.XStream.marshal(XStream.java:1026)
at com.thoughtworks.xstream.XStream.marshal(XStream.java:1015)
at com.thoughtworks.xstream.XStream.toXML(XStream.java:988)
at hudson.XmlFile.write(XmlFile.java:194)
... 24 more
Caused by: java.lang.RuntimeException: Failed to serialize org.jenkinsci.plugins.workflow.cps.actions.ArgumentsActionImpl#arguments for class org.jenkinsci.plugins.workflow.cps.actions.ArgumentsActionImpl
at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256)
at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224)
at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138)
at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209)
at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:88)
at com.thoughtworks.xstream.converters.collections.AbstractCollectionConverter.writeItem(AbstractCollectionConverter.java:64)
at com.thoughtworks.xstream.converters.collections.ArrayConverter.marshal(ArrayConverter.java:45)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)
... 37 more
Caused by: java.lang.RuntimeException: Failed to serialize org.jfrog.hudson.pipeline.types.MavenBuild#deployer for class org.jfrog.hudson.pipeline.types.MavenBuild
at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256)
at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224)
at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138)
at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209)
at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:88)
at com.thoughtworks.xstream.converters.collections.AbstractCollectionConverter.writeItem(AbstractCollectionConverter.java:64)
at com.thoughtworks.xstream.converters.collections.MapConverter.marshal(MapConverter.java:79)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)
... 52 more
Caused by: java.lang.RuntimeException: Failed to serialize org.jfrog.hudson.pipeline.types.deployers.Deployer#properties for class org.jfrog.hudson.pipeline.types.deployers.MavenDeployer
at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256)
at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224)
at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138)
at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209)
at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)
... 67 more
Caused by: java.lang.UnsupportedOperationException: Refusing to marshal com.google.common.collect.ArrayListMultimap for security reasons; see https://jenkins.io/redirect/class-filter/
at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:530)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)
... 76 more

Nicholas Tones added a comment - 2018-01-17 10:37 Further to this on the master I am seeing the following errors reported for this pipeline build: Jan 17, 2018 10:17:43 AM org.jenkinsci.plugins.workflow.graph.FlowNode persistSafe WARNING: failed to save actions for FlowNode id=24 java.io.IOException: java.lang.RuntimeException: Failed to serialize org.jenkinsci.plugins.workflow.support.storage.SimpleXStreamFlowNodeStorage$Tag#actions for class org.jenkinsci.plugins.workflow.support.storage.SimpleXStreamFlowNodeStorage$Tag at hudson.XmlFile.write(XmlFile.java:201) at org.jenkinsci.plugins.workflow.support.storage.SimpleXStreamFlowNodeStorage.saveActions(SimpleXStreamFlowNodeStorage.java:111) at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution$TimingFlowNodeStorage.saveActions(CpsFlowExecution.java:1490) at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution.saveActions(CpsFlowExecution.java:1014) at org.jenkinsci.plugins.workflow.graph.FlowNode.save(FlowNode.java:446) at org.jenkinsci.plugins.workflow.graph.FlowNode.persistSafe(FlowNode.java:452) at org.jenkinsci.plugins.workflow.graph.FlowNode.access$100(FlowNode.java:61) at org.jenkinsci.plugins.workflow.graph.FlowNode$1.add(FlowNode.java:411) at org.jenkinsci.plugins.workflow.graph.FlowNode$1.add(FlowNode.java:401) at java.util.AbstractList.add(Unknown Source) at hudson.model.Actionable.addAction(Actionable.java:155) at org.jenkinsci.plugins.workflow.cps.FlowHead.markIfFail(FlowHead.java:144) at org.jenkinsci.plugins.workflow.cps.CpsStepContext$2.onSuccess(CpsStepContext.java:439) at org.jenkinsci.plugins.workflow.cps.CpsStepContext$2.onSuccess(CpsStepContext.java:395) at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution$4$1.run(CpsFlowExecution.java:746) at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$1.run(CpsVmExecutorService.java:35) at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.util.concurrent.FutureTask.run(Unknown Source) at hudson.remoting.SingleLaneExecutorService$1.run(SingleLaneExecutorService.java:131) at jenkins.util.ContextResettingExecutorService$1.run(ContextResettingExecutorService.java:28) at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.util.concurrent.FutureTask.run(Unknown Source) at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.lang.Thread.run(Unknown Source) Caused by: java.lang.RuntimeException: Failed to serialize org.jenkinsci.plugins.workflow.support.storage.SimpleXStreamFlowNodeStorage$Tag#actions for class org.jenkinsci.plugins.workflow.support.storage.SimpleXStreamFlowNodeStorage$Tag at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256) at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224) at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138) at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209) at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43) at com.thoughtworks.xstream.core.TreeMarshaller.start(TreeMarshaller.java:82) at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.marshal(AbstractTreeMarshallingStrategy.java:37) at com.thoughtworks.xstream.XStream.marshal(XStream.java:1026) at com.thoughtworks.xstream.XStream.marshal(XStream.java:1015) at com.thoughtworks.xstream.XStream.toXML(XStream.java:988) at hudson.XmlFile.write(XmlFile.java:194) ... 24 more Caused by: java.lang.RuntimeException: Failed to serialize org.jenkinsci.plugins.workflow.cps.actions.ArgumentsActionImpl#arguments for class org.jenkinsci.plugins.workflow.cps.actions.ArgumentsActionImpl at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256) at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224) at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138) at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209) at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:88) at com.thoughtworks.xstream.converters.collections.AbstractCollectionConverter.writeItem(AbstractCollectionConverter.java:64) at com.thoughtworks.xstream.converters.collections.ArrayConverter.marshal(ArrayConverter.java:45) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84) at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265) at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252) ... 37 more Caused by: java.lang.RuntimeException: Failed to serialize org.jfrog.hudson.pipeline.types.MavenBuild#deployer for class org.jfrog.hudson.pipeline.types.MavenBuild at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256) at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224) at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138) at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209) at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:88) at com.thoughtworks.xstream.converters.collections.AbstractCollectionConverter.writeItem(AbstractCollectionConverter.java:64) at com.thoughtworks.xstream.converters.collections.MapConverter.marshal(MapConverter.java:79) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84) at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265) at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252) ... 52 more Caused by: java.lang.RuntimeException: Failed to serialize org.jfrog.hudson.pipeline.types.deployers.Deployer#properties for class org.jfrog.hudson.pipeline.types.deployers.MavenDeployer at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256) at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224) at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138) at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209) at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84) at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265) at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252) ... 67 more Caused by: java.lang.UnsupportedOperationException: Refusing to marshal com.google.common.collect.ArrayListMultimap for security reasons; see https://jenkins.io/redirect/class-filter/ at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:530) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84) at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265) at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252) ... 76 more

Nicholas Tones added a comment - 2018-01-17 11:20 - edited

I have attempted to use the

-Dhudson.remoting.ClassFilter.DEFAULTS_OVERRIDE_LOCATION JVM arg pointing to a file containing the following entries:

^bsh[.].*
^com[.]google[.]inject[.].*
^com[.]google[.]common[.]collect[.].*
^com[.]mchange[.]v2[.]c3p0[.].*
^com[.]sun[.]jndi[.].*
^com[.]sun[.]corba[.].*
^com[.]sun[.]javafx[.].*
^com[.]sun[.]org[.]apache[.]regex[.]internal[.].*
^java[.]awt[.].*
^java[.]lang[.]reflect[.]Method$
^java[.]rmi[.].*
^javax[.]management[.].*
^javax[.]naming[.].*
^javax[.]script[.].*
^javax[.]swing[.].*
^net[.]sf[.]json[.].*
^org[.]apache[.]commons[.]beanutils[.].*
^org[.]apache[.]commons[.]collections[.]functors[.].*
^org[.]apache[.]myfaces[.].*
^org[.]apache[.]wicket[.].*
.*org[.]apache[.]xalan.*
^org[.]codehaus[.]groovy[.]runtime[.].*
^org[.]hibernate[.].*
^org[.]python[.].*
^org[.]springframework[.](?!(\\p{Alnum}+[.])*\\p{Alnum}*Exception$).*
^org[.]jfrog[.]build[.]client[.].*
^sun[.]rmi[.].*
^javax[.]imageio[.].*
^java[.]util[.]ServiceLoader$
^java[.]net[.]URLClassLoader$
^java[.]security[.]SignedObject$

The linux slave complains about the springframework Exceptions regex so I had to remove that from the slave whitelist file.

Attempts to run the build again with the whitelist result in a slightly different error:

java.lang.SecurityException: Rejected: com.google.common.collect.ArrayListMultimap
	at hudson.remoting.ClassFilter.check(ClassFilter.java:64)
	at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:124)
	at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1826)
	at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1713)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2000)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535)
	at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2245)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2169)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2027)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535)
	at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2245)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2169)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2027)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535)
	at java.io.ObjectInputStream.readObject(ObjectInputStream.java:422)
	at hudson.remoting.UserRequest.deserialize(UserRequest.java:277)
	at hudson.remoting.UserRequest.perform(UserRequest.java:188)
Also:   hudson.remoting.Channel$CallSiteStackTrace: Remote call to artifactory_slave
		at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1696)
		at hudson.remoting.UserResponse.retrieve(UserRequest.java:313)
		at hudson.remoting.Channel.call(Channel.java:909)
		at hudson.FilePath.act(FilePath.java:998)
		at hudson.FilePath.act(FilePath.java:987)
		at org.jfrog.hudson.pipeline.types.buildInfo.BuildInfo.appendDeployableArtifacts(BuildInfo.java:159)
		at org.jfrog.hudson.pipeline.steps.ArtifactoryMavenBuild$Execution.run(ArtifactoryMavenBuild.java:112)
		at org.jfrog.hudson.pipeline.steps.ArtifactoryMavenBuild$Execution.run(ArtifactoryMavenBuild.java:61)
		at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47)
		at hudson.security.ACL.impersonate(ACL.java:274)
		at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44)
		at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
		at java.util.concurrent.FutureTask.run(Unknown Source)
		at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
		at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
		at java.lang.Thread.run(Unknown Source)
Caused: java.lang.Error: Failed to deserialize the Callable object.
	at hudson.remoting.UserRequest.perform(UserRequest.java:194)
	at hudson.remoting.UserRequest.perform(UserRequest.java:53)
	at hudson.remoting.Request$2.run(Request.java:358)
	at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:72)
	at java.util.concurrent.FutureTask.run(FutureTask.java:266)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
	at java.lang.Thread.run(Thread.java:748)
Caused: java.io.IOException: Remote call on artifactory_slave failed
	at hudson.remoting.Channel.call(Channel.java:917)
	at hudson.FilePath.act(FilePath.java:998)
Caused: java.io.IOException: remote file operation failed: /home/jenkins/workspace/CFA_WEBSITE_PIPELINE@tmp at hudson.remoting.Channel@74558682:artifactory_slave
	at hudson.FilePath.act(FilePath.java:1005)
	at hudson.FilePath.act(FilePath.java:987)
	at org.jfrog.hudson.pipeline.types.buildInfo.BuildInfo.appendDeployableArtifacts(BuildInfo.java:159)
	at org.jfrog.hudson.pipeline.steps.ArtifactoryMavenBuild$Execution.run(ArtifactoryMavenBuild.java:112)
	at org.jfrog.hudson.pipeline.steps.ArtifactoryMavenBuild$Execution.run(ArtifactoryMavenBuild.java:61)
	at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47)
	at hudson.security.ACL.impersonate(ACL.java:274)
	at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44)
	at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
	at java.util.concurrent.FutureTask.run(Unknown Source)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
	at java.lang.Thread.run(Unknown Source)

Nicholas Tones added a comment - 2018-01-17 11:20 - edited I have attempted to use the -Dhudson.remoting.ClassFilter.DEFAULTS_OVERRIDE_LOCATION JVM arg pointing to a file containing the following entries: ^bsh[.].* ^com[.]google[.]inject[.].* ^com[.]google[.]common[.]collect[.].* ^com[.]mchange[.]v2[.]c3p0[.].* ^com[.]sun[.]jndi[.].* ^com[.]sun[.]corba[.].* ^com[.]sun[.]javafx[.].* ^com[.]sun[.]org[.]apache[.]regex[.]internal[.].* ^java[.]awt[.].* ^java[.]lang[.]reflect[.]Method$ ^java[.]rmi[.].* ^javax[.]management[.].* ^javax[.]naming[.].* ^javax[.]script[.].* ^javax[.]swing[.].* ^net[.]sf[.]json[.].* ^org[.]apache[.]commons[.]beanutils[.].* ^org[.]apache[.]commons[.]collections[.]functors[.].* ^org[.]apache[.]myfaces[.].* ^org[.]apache[.]wicket[.].* .*org[.]apache[.]xalan.* ^org[.]codehaus[.]groovy[.]runtime[.].* ^org[.]hibernate[.].* ^org[.]python[.].* ^org[.]springframework[.](?!(\\p{Alnum}+[.])*\\p{Alnum}*Exception$).* ^org[.]jfrog[.]build[.]client[.].* ^sun[.]rmi[.].* ^javax[.]imageio[.].* ^java[.]util[.]ServiceLoader$ ^java[.]net[.]URLClassLoader$ ^java[.]security[.]SignedObject$ The linux slave complains about the springframework Exceptions regex so I had to remove that from the slave whitelist file. Attempts to run the build again with the whitelist result in a slightly different error: java.lang.SecurityException: Rejected: com.google.common.collect.ArrayListMultimap at hudson.remoting.ClassFilter.check(ClassFilter.java:64) at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:124) at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1826) at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1713) at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2000) at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535) at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2245) at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2169) at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2027) at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535) at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2245) at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2169) at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2027) at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1535) at java.io.ObjectInputStream.readObject(ObjectInputStream.java:422) at hudson.remoting.UserRequest.deserialize(UserRequest.java:277) at hudson.remoting.UserRequest.perform(UserRequest.java:188) Also: hudson.remoting.Channel$CallSiteStackTrace: Remote call to artifactory_slave at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1696) at hudson.remoting.UserResponse.retrieve(UserRequest.java:313) at hudson.remoting.Channel.call(Channel.java:909) at hudson.FilePath.act(FilePath.java:998) at hudson.FilePath.act(FilePath.java:987) at org.jfrog.hudson.pipeline.types.buildInfo.BuildInfo.appendDeployableArtifacts(BuildInfo.java:159) at org.jfrog.hudson.pipeline.steps.ArtifactoryMavenBuild$Execution.run(ArtifactoryMavenBuild.java:112) at org.jfrog.hudson.pipeline.steps.ArtifactoryMavenBuild$Execution.run(ArtifactoryMavenBuild.java:61) at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47) at hudson.security.ACL.impersonate(ACL.java:274) at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44) at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.util.concurrent.FutureTask.run(Unknown Source) at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.lang. Thread .run(Unknown Source) Caused: java.lang.Error: Failed to deserialize the Callable object. at hudson.remoting.UserRequest.perform(UserRequest.java:194) at hudson.remoting.UserRequest.perform(UserRequest.java:53) at hudson.remoting.Request$2.run(Request.java:358) at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:72) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) at java.lang. Thread .run( Thread .java:748) Caused: java.io.IOException: Remote call on artifactory_slave failed at hudson.remoting.Channel.call(Channel.java:917) at hudson.FilePath.act(FilePath.java:998) Caused: java.io.IOException: remote file operation failed: /home/jenkins/workspace/CFA_WEBSITE_PIPELINE@tmp at hudson.remoting.Channel@74558682:artifactory_slave at hudson.FilePath.act(FilePath.java:1005) at hudson.FilePath.act(FilePath.java:987) at org.jfrog.hudson.pipeline.types.buildInfo.BuildInfo.appendDeployableArtifacts(BuildInfo.java:159) at org.jfrog.hudson.pipeline.steps.ArtifactoryMavenBuild$Execution.run(ArtifactoryMavenBuild.java:112) at org.jfrog.hudson.pipeline.steps.ArtifactoryMavenBuild$Execution.run(ArtifactoryMavenBuild.java:61) at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47) at hudson.security.ACL.impersonate(ACL.java:274) at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44) at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) at java.util.concurrent.FutureTask.run(Unknown Source) at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) at java.lang. Thread .run(Unknown Source)

Oleg Nenashev made changes - 2018-01-17 11:35

Labels

Original: ~~JENKINS-47736~~ artifactory-plugin

New: ~~JENKINS-47736~~ artifactory-plugin jep-200

Oleg Nenashev added a comment - 2018-01-17 11:36

Some bits (Remoting failure) are already addressed in ~~JENKINS-48983~~. Looking into the XStream issue

Oleg Nenashev added a comment - 2018-01-17 11:36 Some bits (Remoting failure) are already addressed in JENKINS-48983 . Looking into the XStream issue

Oleg Nenashev made changes - 2018-01-17 11:36

Link

New: This issue is related to ~~JENKINS-48983~~ [ ~~JENKINS-48983~~ ]

Oleg Nenashev made changes - 2018-01-17 11:43

Remote Link

New: This issue links to "https://github.com/jenkinsci/artifactory-plugin/pull/30 (Web Link)" [ 19869 ]

Oleg Nenashev made changes - 2018-01-17 11:43

Assignee

Original: Eyal Ben Moshe [ eyalbe ]

New: Oleg Nenashev [ oleg_nenashev ]

Oleg Nenashev made changes - 2018-01-17 11:43

Status

Original: Open [ 1 ]

New: In Progress [ 3 ]

Assignee:: Oleg Nenashev

Reporter:: Nicholas Tones

Votes:: 3 Vote for this issue

Watchers:: 8 Start watching this issue

Created:: 2018-01-17 10:35

Updated:: 2024-07-11 23:33

Resolved:: 2018-01-29 21:02

Jenkins

Details

Description

Attachments

Issue Links

Activity

Collapse comment: Nicholas Tones added a comment - 2018-01-17 10:37

Expand comment: Nicholas Tones added a comment - 2018-01-17 10:37

Collapse comment: Nicholas Tones added a comment - 2018-01-17 11:20, Edited by Nicholas Tones - 2018-01-17 11:21

Expand comment: Nicholas Tones added a comment - 2018-01-17 11:20, Edited by Nicholas Tones - 2018-01-17 11:21

Collapse comment: Oleg Nenashev added a comment - 2018-01-17 11:36

Expand comment: Oleg Nenashev added a comment - 2018-01-17 11:36

People

Dates