I'm not sure whether it should be in the core section because warning doesn't specify any plugin. After upgrading to Jenkins 2.103 I found the following message in the Jenkins logs:

      Jan 25, 2018 8:37:27 PM WARNING jenkins.security.ClassFilterImpl lambda$isBlacklisted$1
      java.text.SimpleDateFormat in JRE might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      This problem causes another one - after each build I can find in the logs things like this:
      Jan 25, 2018 8:40:22 PM SEVERE hudson.model.Run execute
      Failed to save build record
      java.lang.UnsupportedOperationException: Refusing to marshal java.text.SimpleDateFormat for security reasons; see https://jenkins.io/redirect/class-filter/
      	at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:530)
      	at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
      	at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
      	at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
      	at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
      	at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)
      Caused: java.lang.RuntimeException: Failed to serialize com.github.jenkins.lastchanges.model.CommitInfo#dateFormat for class com.github.jenkins.lastchanges.model.CommitInfo
      	at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256)
      	at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224)
      	at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138)
      	at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209)
      	at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150)
      	at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
      	at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
      	at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
      	at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
      	at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)
      Caused: java.lang.RuntimeException: Failed to serialize com.github.jenkins.lastchanges.model.LastChanges#currentRevision for class com.github.jenkins.lastchanges.model.LastChanges
      	at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256)
      	at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224)
      	at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138)
      	at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209)
      	at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150)
      	at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
      	at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
      	at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
      	at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
      	at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)
      Caused: java.lang.RuntimeException: Failed to serialize com.github.jenkins.lastchanges.LastChangesBuildAction#buildChanges for class com.github.jenkins.lastchanges.LastChangesBuildAction
      	at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256)
      	at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224)
      	at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138)
      	at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209)
      	at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150)
      	at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
      	at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
      	at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43)
      	at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:88)
      	at com.thoughtworks.xstream.converters.collections.AbstractCollectionConverter.writeItem(AbstractCollectionConverter.java:64)
      	at com.thoughtworks.xstream.converters.collections.CollectionConverter.marshal(CollectionConverter.java:74)
      	at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
      	at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
      	at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84)
      	at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265)
      	at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252)
      Caused: java.lang.RuntimeException: Failed to serialize hudson.model.Actionable#actions for class hudson.model.FreeStyleBuild
      	at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256)
      	at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224)
      	at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138)
      	at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209)
      	at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150)
      	at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69)
      	at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58)
      	at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43)
      	at com.thoughtworks.xstream.core.TreeMarshaller.start(TreeMarshaller.java:82)
      	at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.marshal(AbstractTreeMarshallingStrategy.java:37)
      	at com.thoughtworks.xstream.XStream.marshal(XStream.java:1026)
      	at com.thoughtworks.xstream.XStream.marshal(XStream.java:1015)
      	at com.thoughtworks.xstream.XStream.toXML(XStream.java:988)
      	at hudson.XmlFile.write(XmlFile.java:194)
      Caused: java.io.IOException
      	at hudson.XmlFile.write(XmlFile.java:201)
      	at hudson.model.Run.save(Run.java:1923)
      	at hudson.model.Run.execute(Run.java:1784)
      	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
      	at hudson.model.ResourceController.execute(ResourceController.java:97)
      	at hudson.model.Executor.run(Executor.java:429)
      

      As you can see there are two mentioned models, so I am not sure if problem faces the Last Changes Plugin or it's just core bug. Or maybe even out of Jenkins.

          [JENKINS-49176] SimpleDateFormat is not whitelisted - JEP-200

          Oleg Nenashev added a comment -

          rmpestano The issue is still there from what I see. https://github.com/jenkinsci/last-changes-plugin/blob/master/src/main/java/com/github/jenkins/lastchanges/model/CommitInfo.java#L22 gets serialized to the disk once you save the commit info.

          Actually, the code is not thread-safe. SimpleDateFormat is NOT thread-safe, and parallel calls to the format() method may cause an issue in the code. I would recommend to remove the field and to call DateFormat.getDateTimeInstance() in the format() call.

          If you want, I can propose a pull-request for that

          Oleg Nenashev added a comment - rmpestano The issue is still there from what I see. https://github.com/jenkinsci/last-changes-plugin/blob/master/src/main/java/com/github/jenkins/lastchanges/model/CommitInfo.java#L22 gets serialized to the disk once you save the commit info. Actually, the code is not thread-safe. SimpleDateFormat is NOT thread-safe , and parallel calls to the format() method may cause an issue in the code. I would recommend to remove the field and to call DateFormat.getDateTimeInstance() in the format() call. If you want, I can propose a pull-request for that

          Hi oleg_nenashev, I've made the date format transient and looks like it solved the issue but if you have a better fix please send the PR. Thank you!

          Rafael Pestano added a comment - Hi oleg_nenashev , I've made the date format transient and looks like it solved the issue but if you have a better fix please send the PR. Thank you!

          Emil Wypych added a comment -

          Ok, so rmpestano should I check plugin provided by you anyway, or shall I wait for the fix via the official way? From my perspective, there is no major issue for our Jenkins, so if you know what causes the problem, I can wait for the official update.

          Emil Wypych added a comment - Ok, so rmpestano should I check plugin provided by you anyway, or shall I wait for the fix via the official way? From my perspective, there is no major issue for our Jenkins, so if you know what causes the problem, I can wait for the official update.

          Oleg Nenashev added a comment -

          Oleg Nenashev added a comment - Created a fix: https://github.com/jenkinsci/last-changes-plugin/pull/41

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          pom.xml
          http://jenkins-ci.org/commit/last-changes-plugin/9f6c24bff13f8a145aa70ea84e9674c691e2fd18
          Log:
          JENKINS-49176 - Update the plugin POM to make it runnable in PCT (mostly upper bounds)

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: pom.xml http://jenkins-ci.org/commit/last-changes-plugin/9f6c24bff13f8a145aa70ea84e9674c691e2fd18 Log: JENKINS-49176 - Update the plugin POM to make it runnable in PCT (mostly upper bounds)

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          Jenkinsfile
          http://jenkins-ci.org/commit/last-changes-plugin/60842ea63304d71bc991cb3a5cecd31e01e958e3
          Log:
          JENKINS-49176 - Add Jenkinsfile for building on ci.jenkins.io

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: Jenkinsfile http://jenkins-ci.org/commit/last-changes-plugin/60842ea63304d71bc991cb3a5cecd31e01e958e3 Log: JENKINS-49176 - Add Jenkinsfile for building on ci.jenkins.io

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          src/main/java/com/github/jenkins/lastchanges/LastChangesPublisher.java
          src/main/java/com/github/jenkins/lastchanges/model/CommitInfo.java
          http://jenkins-ci.org/commit/last-changes-plugin/cf4f17f53d5b07f6db593fbc361acf3f20c6068a
          Log:
          [JENKINS-49176/JENKINS-49185] - Do not cache the SimpleDateFormat format (JEP-200 & concurrency)

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: src/main/java/com/github/jenkins/lastchanges/LastChangesPublisher.java src/main/java/com/github/jenkins/lastchanges/model/CommitInfo.java http://jenkins-ci.org/commit/last-changes-plugin/cf4f17f53d5b07f6db593fbc361acf3f20c6068a Log: [JENKINS-49176/JENKINS-49185] - Do not cache the SimpleDateFormat format (JEP-200 & concurrency)

          Code changed in jenkins
          User: Rafael M. Pestano
          Path:
          Jenkinsfile
          pom.xml
          src/main/java/com/github/jenkins/lastchanges/LastChangesPublisher.java
          src/main/java/com/github/jenkins/lastchanges/model/CommitInfo.java
          http://jenkins-ci.org/commit/last-changes-plugin/8ea546001e39731785ff49585e486a7d27bd9557
          Log:
          Merge pull request #41 from oleg-nenashev/JENKINS-49176-jep-200

          [JENKINS-49176,JENKINS-49185] - Make the plugin compatible with Jenkins 2.102+ and fix concurrency issues

          Compare: https://github.com/jenkinsci/last-changes-plugin/compare/a3fa178233e3...8ea546001e39

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Rafael M. Pestano Path: Jenkinsfile pom.xml src/main/java/com/github/jenkins/lastchanges/LastChangesPublisher.java src/main/java/com/github/jenkins/lastchanges/model/CommitInfo.java http://jenkins-ci.org/commit/last-changes-plugin/8ea546001e39731785ff49585e486a7d27bd9557 Log: Merge pull request #41 from oleg-nenashev/ JENKINS-49176 -jep-200 [JENKINS-49176,JENKINS-49185] - Make the plugin compatible with Jenkins 2.102+ and fix concurrency issues Compare: https://github.com/jenkinsci/last-changes-plugin/compare/a3fa178233e3...8ea546001e39

          Hi oleg_nenashev,

          I've just reviewed you PR and it looks great, also tested on our company Jenkins instance. I'll release v2.6 soon.

          thank you very much!

           

           

          Rafael Pestano added a comment - Hi oleg_nenashev , I've just reviewed you PR and it looks great, also tested on our company Jenkins instance. I'll release v2.6 soon. thank you very much!    

          Oleg Nenashev added a comment -

          It has been released in Last Changes 2.6

          Oleg Nenashev added a comment - It has been released in Last Changes 2.6

            oleg_nenashev Oleg Nenashev
            ewypych Emil Wypych
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: