[JENKINS-49237] CPPNCSS Plugin fails with "WARNING: java.util.Calendar in JRE might be dangerous,"

Type: Bug
Resolution: Fixed
Priority: Blocker
Component/s: cppncss-plugin
Labels:
- JEP-200
Environment:
Jenkins 2.103
CppNCSS plugin 1.1

Similar Issues:
Powered by SuggestiMate

Show

As in summary - after upgrading Jenkins all jobs using CppNCSS plugin fail with SecurityException. Whitelisting java.utils.Calendar does not help (or I'm doing it wrong).

Quick look into plugin's code shows "Calendar" being used in BuildProxy class, which is marked Serializable...

Complete info from build log:

java.lang.SecurityException: Rejected: java.util.Calendar
	at hudson.remoting.ClassFilter.check(ClassFilter.java:75)
	at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:129)
	at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1863)
	at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
	at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1880)
	at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2037)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
	at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2282)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2206)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2064)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
	at java.io.ObjectInputStream.readObject(ObjectInputStream.java:428)
	at hudson.remoting.UserRequest.deserialize(UserRequest.java:277)
	at hudson.remoting.UserResponse.retrieve(UserRequest.java:310)
	at hudson.remoting.Channel.call(Channel.java:909)
	at hudson.FilePath.act(FilePath.java:1093)
	at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:68)
	at hudson.plugins.helpers.AbstractPublisherImpl.perform(AbstractPublisherImpl.java:30)
	at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
	at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
	at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
	at hudson.model.Build$BuildExecution.post2(Build.java:186)
	at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
	at hudson.model.Run.execute(Run.java:1752)
	at hudson.matrix.MatrixRun.run(MatrixRun.java:146)
	at hudson.model.ResourceController.execute(ResourceController.java:97)
	at hudson.model.Executor.run(Executor.java:429)
ERROR: Build step failed with exception
java.lang.SecurityException: Rejected: java.util.Calendar
	at hudson.remoting.ClassFilter.check(ClassFilter.java:75)
	at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:129)
	at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1863)
	at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
	at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1880)
	at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2037)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
	at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2282)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2206)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2064)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
	at java.io.ObjectInputStream.readObject(ObjectInputStream.java:428)
	at hudson.remoting.UserRequest.deserialize(UserRequest.java:277)
	at hudson.remoting.UserResponse.retrieve(UserRequest.java:310)
	at hudson.remoting.Channel.call(Channel.java:909)
	at hudson.FilePath.act(FilePath.java:1093)
	at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:68)
Caused: java.lang.RuntimeException: Unexpected exception
	at hudson.plugins.helpers.BuildProxy.unwrapException(BuildProxy.java:115)
	at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:77)
	at hudson.plugins.helpers.AbstractPublisherImpl.perform(AbstractPublisherImpl.java:30)
	at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
	at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
	at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
	at hudson.model.Build$BuildExecution.post2(Build.java:186)
	at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
	at hudson.model.Run.execute(Run.java:1752)
	at hudson.matrix.MatrixRun.run(MatrixRun.java:146)
	at hudson.model.ResourceController.execute(ResourceController.java:97)
	at hudson.model.Executor.run(Executor.java:429)
Build step 'Publish Cpp NCSS Report' marked build as failure

is related to

JENKINS-47736 JEP-200: Switch Remoting/XStream blacklist to a whitelist

Resolved

links to

https://github.com/jenkinsci/cppncss-plugin/pull/2

Konrad Grochowski created issue - 2018-01-29 20:20

Konrad Grochowski made changes - 2018-01-29 20:21

Link

New: This issue is related to ~~JENKINS-47736~~ [ ~~JENKINS-47736~~ ]

Konrad Grochowski made changes - 2018-01-29 20:21

Labels

New: JEP-200

Konrad Grochowski made changes - 2018-01-29 20:24

Description

Original: As in summary - after upgrading Jenkins all jobs using CppNCSS plugin fail with SecurityException. Whitelisting java.utils.Calendar does not help (or I'm doing it wrong).

Oleg Nenashev added a comment - 2018-01-29 22:09

Full stacktraces would be useful

Oleg Nenashev added a comment - 2018-01-29 22:09 Full stacktraces would be useful

Oleg Nenashev made changes - 2018-01-30 07:49

Assignee

New: Oleg Nenashev [ oleg_nenashev ]

Oleg Nenashev made changes - 2018-01-30 07:49

Status

Original: Open [ 1 ]

New: In Progress [ 3 ]

Oleg Nenashev added a comment - 2018-01-30 08:02

java.util.Calendar is an abstract class. It won't be enough to serialize it. It would be great to just replace Calendar type by another type in BuildProxy

Oleg Nenashev added a comment - 2018-01-30 08:02 java.util.Calendar is an abstract class. It won't be enough to serialize it. It would be great to just replace Calendar type by another type in BuildProxy

Konrad Grochowski made changes - 2018-01-30 11:18

Description

Original: As in summary - after upgrading Jenkins all jobs using CppNCSS plugin fail with SecurityException. Whitelisting java.utils.Calendar does not help (or I'm doing it wrong).

Quick look into plugin's code shows "Calendar" being used in BuildProxy class, which is marked Serializable...

New: As in summary - after upgrading Jenkins all jobs using CppNCSS plugin fail with SecurityException. Whitelisting java.utils.Calendar does not help (or I'm doing it wrong).

Quick look into plugin's code shows "Calendar" being used in BuildProxy class, which is marked Serializable...

Complete info from build log:
{code:java}
java.lang.SecurityException: Rejected: java.util.Calendar
at hudson.remoting.ClassFilter.check(ClassFilter.java:75)
at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:129)
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1863)
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1880)
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2037)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2282)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2206)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2064)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:428)
at hudson.remoting.UserRequest.deserialize(UserRequest.java:277)
at hudson.remoting.UserResponse.retrieve(UserRequest.java:310)
at hudson.remoting.Channel.call(Channel.java:909)
at hudson.FilePath.act(FilePath.java:1093)
at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:68)
at hudson.plugins.helpers.AbstractPublisherImpl.perform(AbstractPublisherImpl.java:30)
at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
at hudson.model.Build$BuildExecution.post2(Build.java:186)
at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
at hudson.model.Run.execute(Run.java:1752)
at hudson.matrix.MatrixRun.run(MatrixRun.java:146)
at hudson.model.ResourceController.execute(ResourceController.java:97)
at hudson.model.Executor.run(Executor.java:429)
ERROR: Build step failed with exception
java.lang.SecurityException: Rejected: java.util.Calendar
at hudson.remoting.ClassFilter.check(ClassFilter.java:75)
at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:129)
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1863)
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1880)
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2037)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2282)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2206)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2064)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:428)
at hudson.remoting.UserRequest.deserialize(UserRequest.java:277)
at hudson.remoting.UserResponse.retrieve(UserRequest.java:310)
at hudson.remoting.Channel.call(Channel.java:909)
at hudson.FilePath.act(FilePath.java:1093)
at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:68)
Caused: java.lang.RuntimeException: Unexpected exception
at hudson.plugins.helpers.BuildProxy.unwrapException(BuildProxy.java:115)
at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:77)
at hudson.plugins.helpers.AbstractPublisherImpl.perform(AbstractPublisherImpl.java:30)
at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
at hudson.model.Build$BuildExecution.post2(Build.java:186)
at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
at hudson.model.Run.execute(Run.java:1752)
at hudson.matrix.MatrixRun.run(MatrixRun.java:146)
at hudson.model.ResourceController.execute(ResourceController.java:97)
at hudson.model.Executor.run(Executor.java:429)
Build step 'Publish Cpp NCSS Report' marked build as failure{code}

Konrad Grochowski added a comment - 2018-01-30 11:56

stacktraces added

Konrad Grochowski added a comment - 2018-01-30 11:56 stacktraces added

Assignee:: Oleg Nenashev

Reporter:: Konrad Grochowski

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Created:: 2018-01-29 20:20

Updated:: 2018-02-05 11:02

Resolved:: 2018-02-03 22:23

Jenkins

Details

Description

Attachments

Issue Links

Activity

Collapse comment: Oleg Nenashev added a comment - 2018-01-29 22:09

Expand comment: Oleg Nenashev added a comment - 2018-01-29 22:09

Collapse comment: Oleg Nenashev added a comment - 2018-01-30 08:02

Expand comment: Oleg Nenashev added a comment - 2018-01-30 08:02

Collapse comment: Konrad Grochowski added a comment - 2018-01-30 11:56

Expand comment: Konrad Grochowski added a comment - 2018-01-30 11:56

People

Dates