Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-49586

JDepend plugin classes not in JEP-200 whitelist

XMLWordPrintable

      From what I'm reading about JEP-200, it seems that the (old) JDepend plugin's classes might not have been included in the whitelisting.

       

      WARNING: org.codehaus.mojo.jdepend.objects.JDPackage in file:/var/lib/jenkins/plugins/jdepend/WEB-INF/lib/jdepend-maven-plugin-2.0-beta-2.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/

      ...

       

      org.codehaus.mojo.jdepend.objects.JDPackage in file:/var/lib/jenkins/plugins/jdepend/WEB-INF/lib/jdepend-maven-plugin-2.0-beta-2.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      Feb 15, 2018 11:20:35 AM SEVERE hudson.model.Run execute
      Failed to save build record java.lang.UnsupportedOperationException: Refusing to marshal org.codehaus.mojo.jdepend.objects.JDPackage for security reasons; see https://jenkins.io/redirect/class-filter/ at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:543) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:88) at com.thoughtworks.xstream.converters.collections.AbstractCollectionConverter.writeItem(AbstractCollectionConverter.java:64) at com.thoughtworks.xstream.converters.collections.CollectionConverter.marshal(CollectionConverter.java:74) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84) at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265) at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252) Caused: java.lang.RuntimeException: Failed to serialize org.codehaus.mojo.jdepend.JDependXMLReportParser#packages for class hudson.plugins.jdepend.JDependParser at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256) at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224) at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138) at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209) at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84) at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265) at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252) Caused: java.lang.RuntimeException: Failed to serialize hudson.plugins.jdepend.JDependBuildAction#jDependParser for class hudson.plugins.jdepend.JDependBuildAction at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256) at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224) at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138) at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209) at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:88) at com.thoughtworks.xstream.converters.collections.AbstractCollectionConverter.writeItem(AbstractCollectionConverter.java:64) at com.thoughtworks.xstream.converters.collections.CollectionConverter.marshal(CollectionConverter.java:74) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84) at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265) at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252) Caused: java.lang.RuntimeException: Failed to serialize hudson.model.Actionable#actions for class hudson.model.FreeStyleBuild at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256) at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224) at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138) at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209) at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43) at com.thoughtworks.xstream.core.TreeMarshaller.start(TreeMarshaller.java:82) at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.marshal(AbstractTreeMarshallingStrategy.java:37) at com.thoughtworks.xstream.XStream.marshal(XStream.java:1026) at com.thoughtworks.xstream.XStream.marshal(XStream.java:1015) at com.thoughtworks.xstream.XStream.toXML(XStream.java:988) at hudson.XmlFile.write(XmlFile.java:193) Caused: java.io.IOException at hudson.XmlFile.write(XmlFile.java:200) at hudson.model.Run.save(Run.java:1923) at hudson.model.Run.execute(Run.java:1784) at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43) at hudson.model.ResourceController.execute(ResourceController.java:97) at hudson.model.Executor.run(Executor.java:429)

       

          [JENKINS-49586] JDepend plugin classes not in JEP-200 whitelist

          Chuck Burgess created issue -
          Chuck Burgess made changes -
          Labels New: JEP-200

          Chuck Burgess added a comment -

          JDepend plugin affected by JEP-200

          Chuck Burgess added a comment - JDepend plugin affected by JEP-200
          Chuck Burgess made changes -
          Link New: This issue relates to JENKINS-47736 [ JENKINS-47736 ]

          Oleg Nenashev added a comment -

          It comes from this dependency:

               <dependency>
          <groupId>org.codehaus.mojo</groupId>
          <artifactId>jdepend-maven-plugin</artifactId>
          <version>2.0-beta-2</version>
      </dependency>

          The code is not on GitHub AFAICT. CC aheritier stephenconnolly. Likely does not matter, because the plugin should not persist the parser on the disk: https://github.com/jenkinsci/jdepend-plugin/blob/master/src/main/java/hudson/plugins/jdepend/JDependBuildAction.java#L23-L36

          From what I see in the code, the logic can be safely replaced by a transient field

          Oleg Nenashev added a comment - It comes from this dependency: <dependency> <groupId> org.codehaus.mojo </groupId> <artifactId> jdepend-maven-plugin </artifactId> <version> 2.0-beta-2 </version> </dependency> The code is not on GitHub AFAICT. CC aheritier stephenconnolly . Likely does not matter, because the plugin should not persist the parser on the disk: https://github.com/jenkinsci/jdepend-plugin/blob/master/src/main/java/hudson/plugins/jdepend/JDependBuildAction.java#L23-L36 From what I see in the code, the logic can be safely replaced by a transient field
          Oleg Nenashev made changes -
          Assignee New: Oleg Nenashev [ oleg_nenashev ]
          Oleg Nenashev made changes -
          Status Original: Open [ 1 ] New: In Progress [ 3 ]

          Oleg Nenashev added a comment -

          Created https://github.com/jenkinsci/jdepend-plugin/pull/2. Would it be possible to test the snapshot?

          Oleg Nenashev added a comment - Created https://github.com/jenkinsci/jdepend-plugin/pull/2 . Would it be possible to test the snapshot?
          Oleg Nenashev made changes -
          Remote Link New: This issue links to "https://github.com/jenkinsci/jdepend-plugin/pull/2 (Web Link)" [ 20091 ]
          Oleg Nenashev made changes -
          Status Original: In Progress [ 3 ] New: In Review [ 10005 ]

            oleg_nenashev Oleg Nenashev
            thenazg Chuck Burgess
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: