[JENKINS-49237] CPPNCSS Plugin fails with "WARNING: java.util.Calendar in JRE might be dangerous,"

Type: Bug
Resolution: Fixed
Priority: Blocker
Component/s: cppncss-plugin
Labels:
- JEP-200
Environment:
Jenkins 2.103
CppNCSS plugin 1.1

Similar Issues:
Powered by SuggestiMate

Show

As in summary - after upgrading Jenkins all jobs using CppNCSS plugin fail with SecurityException. Whitelisting java.utils.Calendar does not help (or I'm doing it wrong).

Quick look into plugin's code shows "Calendar" being used in BuildProxy class, which is marked Serializable...

Complete info from build log:

java.lang.SecurityException: Rejected: java.util.Calendar
	at hudson.remoting.ClassFilter.check(ClassFilter.java:75)
	at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:129)
	at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1863)
	at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
	at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1880)
	at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2037)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
	at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2282)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2206)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2064)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
	at java.io.ObjectInputStream.readObject(ObjectInputStream.java:428)
	at hudson.remoting.UserRequest.deserialize(UserRequest.java:277)
	at hudson.remoting.UserResponse.retrieve(UserRequest.java:310)
	at hudson.remoting.Channel.call(Channel.java:909)
	at hudson.FilePath.act(FilePath.java:1093)
	at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:68)
	at hudson.plugins.helpers.AbstractPublisherImpl.perform(AbstractPublisherImpl.java:30)
	at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
	at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
	at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
	at hudson.model.Build$BuildExecution.post2(Build.java:186)
	at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
	at hudson.model.Run.execute(Run.java:1752)
	at hudson.matrix.MatrixRun.run(MatrixRun.java:146)
	at hudson.model.ResourceController.execute(ResourceController.java:97)
	at hudson.model.Executor.run(Executor.java:429)
ERROR: Build step failed with exception
java.lang.SecurityException: Rejected: java.util.Calendar
	at hudson.remoting.ClassFilter.check(ClassFilter.java:75)
	at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:129)
	at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1863)
	at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
	at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1880)
	at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2037)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
	at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2282)
	at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2206)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2064)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
	at java.io.ObjectInputStream.readObject(ObjectInputStream.java:428)
	at hudson.remoting.UserRequest.deserialize(UserRequest.java:277)
	at hudson.remoting.UserResponse.retrieve(UserRequest.java:310)
	at hudson.remoting.Channel.call(Channel.java:909)
	at hudson.FilePath.act(FilePath.java:1093)
	at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:68)
Caused: java.lang.RuntimeException: Unexpected exception
	at hudson.plugins.helpers.BuildProxy.unwrapException(BuildProxy.java:115)
	at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:77)
	at hudson.plugins.helpers.AbstractPublisherImpl.perform(AbstractPublisherImpl.java:30)
	at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
	at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
	at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
	at hudson.model.Build$BuildExecution.post2(Build.java:186)
	at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
	at hudson.model.Run.execute(Run.java:1752)
	at hudson.matrix.MatrixRun.run(MatrixRun.java:146)
	at hudson.model.ResourceController.execute(ResourceController.java:97)
	at hudson.model.Executor.run(Executor.java:429)
Build step 'Publish Cpp NCSS Report' marked build as failure

is related to

JENKINS-47736 JEP-200: Switch Remoting/XStream blacklist to a whitelist

Resolved

links to

https://github.com/jenkinsci/cppncss-plugin/pull/2

Konrad Grochowski created issue - 2018-01-29 20:20

Konrad Grochowski made changes - 2018-01-29 20:21

Link

New: This issue is related to ~~JENKINS-47736~~ [ ~~JENKINS-47736~~ ]

Konrad Grochowski made changes - 2018-01-29 20:21

Labels

New: JEP-200

Konrad Grochowski made changes - 2018-01-29 20:24

Description

Original: As in summary - after upgrading Jenkins all jobs using CppNCSS plugin fail with SecurityException. Whitelisting java.utils.Calendar does not help (or I'm doing it wrong).

Oleg Nenashev made changes - 2018-01-30 07:49

Assignee

New: Oleg Nenashev [ oleg_nenashev ]

Oleg Nenashev made changes - 2018-01-30 07:49

Status

Original: Open [ 1 ]

New: In Progress [ 3 ]

Konrad Grochowski made changes - 2018-01-30 11:18

Description

Original: As in summary - after upgrading Jenkins all jobs using CppNCSS plugin fail with SecurityException. Whitelisting java.utils.Calendar does not help (or I'm doing it wrong).

Quick look into plugin's code shows "Calendar" being used in BuildProxy class, which is marked Serializable...

New: As in summary - after upgrading Jenkins all jobs using CppNCSS plugin fail with SecurityException. Whitelisting java.utils.Calendar does not help (or I'm doing it wrong).

Quick look into plugin's code shows "Calendar" being used in BuildProxy class, which is marked Serializable...

Complete info from build log:
{code:java}
java.lang.SecurityException: Rejected: java.util.Calendar
at hudson.remoting.ClassFilter.check(ClassFilter.java:75)
at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:129)
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1863)
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1880)
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2037)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2282)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2206)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2064)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:428)
at hudson.remoting.UserRequest.deserialize(UserRequest.java:277)
at hudson.remoting.UserResponse.retrieve(UserRequest.java:310)
at hudson.remoting.Channel.call(Channel.java:909)
at hudson.FilePath.act(FilePath.java:1093)
at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:68)
at hudson.plugins.helpers.AbstractPublisherImpl.perform(AbstractPublisherImpl.java:30)
at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
at hudson.model.Build$BuildExecution.post2(Build.java:186)
at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
at hudson.model.Run.execute(Run.java:1752)
at hudson.matrix.MatrixRun.run(MatrixRun.java:146)
at hudson.model.ResourceController.execute(ResourceController.java:97)
at hudson.model.Executor.run(Executor.java:429)
ERROR: Build step failed with exception
java.lang.SecurityException: Rejected: java.util.Calendar
at hudson.remoting.ClassFilter.check(ClassFilter.java:75)
at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:129)
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1863)
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1880)
at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1746)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2037)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2282)
at java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2206)
at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2064)
at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1568)
at java.io.ObjectInputStream.readObject(ObjectInputStream.java:428)
at hudson.remoting.UserRequest.deserialize(UserRequest.java:277)
at hudson.remoting.UserResponse.retrieve(UserRequest.java:310)
at hudson.remoting.Channel.call(Channel.java:909)
at hudson.FilePath.act(FilePath.java:1093)
at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:68)
Caused: java.lang.RuntimeException: Unexpected exception
at hudson.plugins.helpers.BuildProxy.unwrapException(BuildProxy.java:115)
at hudson.plugins.helpers.BuildProxy.doPerform(BuildProxy.java:77)
at hudson.plugins.helpers.AbstractPublisherImpl.perform(AbstractPublisherImpl.java:30)
at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
at hudson.model.Build$BuildExecution.post2(Build.java:186)
at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
at hudson.model.Run.execute(Run.java:1752)
at hudson.matrix.MatrixRun.run(MatrixRun.java:146)
at hudson.model.ResourceController.execute(ResourceController.java:97)
at hudson.model.Executor.run(Executor.java:429)
Build step 'Publish Cpp NCSS Report' marked build as failure{code}

Oleg Nenashev made changes - 2018-01-30 14:07

Status

Original: In Progress [ 3 ]

New: In Review [ 10005 ]

Oleg Nenashev made changes - 2018-01-30 14:07

Remote Link

New: This issue links to "https://github.com/jenkinsci/cppncss-plugin/pull/2 (Web Link)" [ 19992 ]

Oleg Nenashev made changes - 2018-02-03 22:23

Resolution		New: Fixed [ 1 ]
Status	Original: In Review [ 10005 ]	New: Resolved [ 5 ]

Assignee:: Oleg Nenashev

Reporter:: Konrad Grochowski

Votes:: 0 Vote for this issue

Watchers:: 3 Start watching this issue

Created:: 2018-01-29 20:20

Updated:: 2018-02-05 11:02

Resolved:: 2018-02-03 22:23

Jenkins

Details

Description

Attachments

Issue Links

Activity

People

Dates