[JENKINS-49715] Packer Plugin Nullpointer Exception and SecurityException: Rejected: net.sf.json.JSONObject

Type: Bug
Resolution: Fixed
Priority: Minor
Component/s: packer-plugin
Labels:
- JEP-200

Similar Issues:
Powered by SuggestiMate

Show
Epic Link:
JEP-200: Switch Remoting/XStream blacklist to a whitelist

I'm not sure if this is related to JEP-200, but after Upgrade I receive these Exceptions when using the Packer Plugin:

Feb 23, 2018 12:39:25 PM hudson.model.Run execute
INFO: packer-centos7 #361 main build action completed: SUCCESS
Feb 23, 2018 12:39:25 PM biz.neustar.jenkins.plugins.packer.PackerPublisher getRemotePackerExec
SEVERE: java.lang.NullPointerException
    at biz.neustar.jenkins.plugins.packer.PackerPublisher.getRemotePackerExec(PackerPublisher.java:217)
    at biz.neustar.jenkins.plugins.packer.PackerPublisher.perform(PackerPublisher.java:301)
    at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
    at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
    at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
    at hudson.model.Build$BuildExecution.post2(Build.java:186)
    at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
    at hudson.model.Run.execute(Run.java:1752)
    at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
    at hudson.model.ResourceController.execute(ResourceController.java:97)
    at hudson.model.Executor.run(Executor.java:429)

Feb 23, 2018 12:39:25 PM biz.neustar.jenkins.plugins.packer.PackerPublisher perform
SEVERE: java.lang.NullPointerException
    at biz.neustar.jenkins.plugins.packer.PackerPublisher.getName(PackerPublisher.java:84)
    at biz.neustar.jenkins.plugins.packer.PackerPublisher.getRemotePackerExec(PackerPublisher.java:223)
    at biz.neustar.jenkins.plugins.packer.PackerPublisher.perform(PackerPublisher.java:301)
    at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
    at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
    at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
    at hudson.model.Build$BuildExecution.post2(Build.java:186)
    at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
    at hudson.model.Run.execute(Run.java:1752)
    at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
    at hudson.model.ResourceController.execute(ResourceController.java:97)
    at hudson.model.Executor.run(Executor.java:429)

Actually this message doesn't apear anymore:

Feb 23, 2018 12:16:47 PM biz.neustar.jenkins.plugins.packer.PackerPublisher getRemotePackerExec
SEVERE: java.io.IOException: Remote call on server failed
        at hudson.remoting.Channel.call(Channel.java:958)
        at biz.neustar.jenkins.plugins.packer.PackerInstallation.getExecutable(PackerInstallation.java:138)
        at biz.neustar.jenkins.plugins.packer.PackerPublisher.getRemotePackerExec(PackerPublisher.java:220)
        at biz.neustar.jenkins.plugins.packer.PackerPublisher.perform(PackerPublisher.java:301)
        at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
        at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
        at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
        at hudson.model.Build$BuildExecution.post2(Build.java:186)
        at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
        at hudson.model.Run.execute(Run.java:1752)
        at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
        at hudson.model.ResourceController.execute(ResourceController.java:97)
        at hudson.model.Executor.run(Executor.java:429)
Caused by: java.lang.Error: Failed to deserialize the Callable object.
        at hudson.remoting.UserRequest.perform(UserRequest.java:194)
        at hudson.remoting.UserRequest.perform(UserRequest.java:53)
        at hudson.remoting.Request$2.run(Request.java:364)
        at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:72)
        at java.util.concurrent.FutureTask.run(FutureTask.java:266)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
        at java.lang.Thread.run(Thread.java:745)
        Suppressed: hudson.remoting.Channel$CallSiteStackTrace: Remote call to server
                at hudson.remoting.Channel.attachCallSiteStackTrace(Channel.java:1737)
                at hudson.remoting.UserResponse.retrieve(UserRequest.java:313)
                at hudson.remoting.Channel.call(Channel.java:952)
                at biz.neustar.jenkins.plugins.packer.PackerInstallation.getExecutable(PackerInstallation.java:138)
                at biz.neustar.jenkins.plugins.packer.PackerPublisher.getRemotePackerExec(PackerPublisher.java:220)
                at biz.neustar.jenkins.plugins.packer.PackerPublisher.perform(PackerPublisher.java:301)
                at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)
                at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:744)
                at hudson.model.AbstractBuild$AbstractBuildExecution.performAllBuildSteps(AbstractBuild.java:690)
                at hudson.model.Build$BuildExecution.post2(Build.java:186)
                at hudson.model.AbstractBuild$AbstractBuildExecution.post(AbstractBuild.java:635)
                at hudson.model.Run.execute(Run.java:1752)
                at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:43)
                at hudson.model.ResourceController.execute(ResourceController.java:97)
                at hudson.model.Executor.run(Executor.java:429)
Caused by: java.lang.SecurityException: Rejected: net.sf.json.JSONObject; see https://jenkins.io/redirect/class-filter/
        at hudson.remoting.ClassFilter.check(ClassFilter.java:64)
        at hudson.remoting.MultiClassLoaderSerializer$Input.resolveClass(MultiClassLoaderSerializer.java:124)
        at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1620)
        at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1521)
        at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:1781)
        at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1353)
        at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2018)

May we fixed this with

-Dhudson.model.ParametersAction.keepUndefinedParameters=true -Dhudson.remoting.ClassFilter=net.sf.json.JSONObject -Dhudson.remoting.Classfilter=jenkins.security.ClassFilterImpl

links to

GitHub issue

PR 22

mentioned in: Page Failed to load

Björn Becker created issue - 2018-02-23 11:42

Björn Becker made changes - 2018-02-23 11:42

Epic Link

New: ~~JENKINS-47736~~ [ 186227 ]

Oleg Nenashev added a comment - 2018-02-23 11:44

I confirm the JEP-200 side of the issue, at least

Oleg Nenashev added a comment - 2018-02-23 11:44 I confirm the JEP-200 side of the issue, at least

Oleg Nenashev made changes - 2018-02-23 11:49

Component/s		New: packer-plugin [ 18827 ]
Component/s	Original: _unsorted [ 19622 ]

Oleg Nenashev added a comment - 2018-02-23 11:52

The plugin has some test automation which could reproduce the issue. The problem is that it's baseline is 1.554.1, which makes the PCT Compatibility facelift a bit tough.

Changes to be done:

Stop serializing JSON objects over the channel
Plugin facelift & PCT

Oleg Nenashev added a comment - 2018-02-23 11:52 The plugin has some test automation which could reproduce the issue. The problem is that it's baseline is 1.554.1, which makes the PCT Compatibility facelift a bit tough. Changes to be done: Stop serializing JSON objects over the channel Plugin facelift & PCT

Oleg Nenashev added a comment - 2018-02-23 11:56

becke22 Note that JSONObjects are Blacklisted in Remoting. Usage of such workarounds is generally a bad idea

Oleg Nenashev added a comment - 2018-02-23 11:56 becke22 Note that JSONObjects are Blacklisted in Remoting. Usage of such workarounds is generally a bad idea

Oleg Nenashev made changes - 2018-02-23 13:43

Remote Link

New: This issue links to "GitHub issue (Web Link)" [ 20140 ]

Oleg Nenashev made changes - 2018-02-23 14:51

Assignee

Original: Oleg Nenashev [ oleg_nenashev ]

New: Jesse Glick [ jglick ]

Jesse Glick made changes - 2018-02-26 19:13

Status

Original: Open [ 1 ]

New: In Progress [ 3 ]

Jesse Glick added a comment - 2018-02-26 19:23

The plugin has some test automation which could reproduce the issue.

Not really. What it has are mocks. Making the existing tests useless for verifying integration issues.

Jesse Glick added a comment - 2018-02-26 19:23 The plugin has some test automation which could reproduce the issue. Not really. What it has are mocks. Making the existing tests useless for verifying integration issues.

Assignee:: Jesse Glick

Reporter:: Björn Becker

Votes:: 0 Vote for this issue

Watchers:: 5 Start watching this issue

Created:: 2018-02-23 11:42

Updated:: 2024-07-11 23:34

Resolved:: 2018-03-20 13:53

Jenkins

Details

Description

Attachments

Issue Links

Activity

Collapse comment: Oleg Nenashev added a comment - 2018-02-23 11:44

Expand comment: Oleg Nenashev added a comment - 2018-02-23 11:44

Collapse comment: Oleg Nenashev added a comment - 2018-02-23 11:52

Expand comment: Oleg Nenashev added a comment - 2018-02-23 11:52

Collapse comment: Oleg Nenashev added a comment - 2018-02-23 11:56

Expand comment: Oleg Nenashev added a comment - 2018-02-23 11:56

Collapse comment: Jesse Glick added a comment - 2018-02-26 19:23

Expand comment: Jesse Glick added a comment - 2018-02-26 19:23

People

Dates