Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-50633

JEP-200 - org.apache.maven.model.Model might be dangerous, so rejecting

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Major Major
    • Jenkins 2.114, Maven Integration plugin 3.1.2, Pipeline Utility Steps 2.0.2

      Errors after update to latest Jenkins version:

      WARNING: org.apache.maven.model.Model in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.DistributionManagement in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.Dependency in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.Build in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.DeploymentRepository in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.Plugin in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.PluginExecution in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.Exclusion in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.Parent in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.codehaus.plexus.util.xml.Xpp3Dom in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/plexus-utils-3.0.24.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.Resource in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      
      WARNING: org.apache.maven.model.Model in file:/var/lib/jenkins/plugins/pipeline-utility-steps/WEB-INF/lib/maven-model-3.3.9.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.DistributionManagement in file:/var/lib/jenkins/plugins/pipeline-utility-steps/WEB-INF/lib/maven-model-3.3.9.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.Plugin in file:/var/lib/jenkins/plugins/pipeline-utility-steps/WEB-INF/lib/maven-model-3.3.9.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.Exclusion in file:/var/lib/jenkins/plugins/pipeline-utility-steps/WEB-INF/lib/maven-model-3.3.9.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.Parent in file:/var/lib/jenkins/plugins/pipeline-utility-steps/WEB-INF/lib/maven-model-3.3.9.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      WARNING: org.apache.maven.model.PluginExecution in file:/var/lib/jenkins/plugins/pipeline-utility-steps/WEB-INF/lib/maven-model-3.3.9.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
      

          [JENKINS-50633] JEP-200 - org.apache.maven.model.Model might be dangerous, so rejecting

          Oleg Nenashev added a comment -

          testuser7 Could you please provide a list of plugins you use + Full stacktraces?
          I would like to track down the plugins using these classes

          Oleg Nenashev added a comment - testuser7 Could you please provide a list of plugins you use + Full stacktraces? I would like to track down the plugins using these classes

          Test User added a comment - - edited

          Plugins list: plugins-list.txt

          There is no any stack trace. Full log:

          Apr 05, 2018 5:14:33 PM jenkins.security.ClassFilterImpl lambda$isBlacklisted$1
          WARNING: org.apache.maven.model.Model in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/
          

          I'm not using maven-plugin for now.
          Step readMavenPom from pipeline-utility-steps is used.

          Test User added a comment - - edited Plugins list: plugins-list.txt There is no any stack trace. Full log: Apr 05, 2018 5:14:33 PM jenkins.security.ClassFilterImpl lambda$isBlacklisted$1 WARNING: org.apache.maven.model.Model in file:/var/lib/jenkins/plugins/maven-plugin/WEB-INF/lib/maven-model-3.1.0.jar might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/ I'm not using maven-plugin for now. Step readMavenPom from pipeline-utility-steps is used.

          Oleg Nenashev added a comment -

          Installing Maven Plugin could reduce the number of issues, but I am not sure I want to recommend it

          Oleg Nenashev added a comment - Installing Maven Plugin could reduce the number of issues, but I am not sure I want to recommend it

          Jesse Glick added a comment -

          I thought this issue was already known?

          IMO this step should just be deleted. Conceptually incompatible with out-of-process execution.

          Anyway, could be fixed by doing parsing on the master side, transferring a String over Remoting.

          Jesse Glick added a comment - I thought this issue was already known? IMO this step should just be deleted. Conceptually incompatible with out-of-process execution. Anyway, could be fixed by doing parsing on the master side, transferring a String over Remoting.

          Oleg Nenashev added a comment -

          I have created https://github.com/jenkinsci/pipeline-utility-steps-plugin/pull/46 with test automation for this case. I believe that Remoting works fine, because the latest version of the plugin does method resolution on the master side (rsandell uses FilePath's stream API for that).

          So the error likely happens while assigning object to a local variable outside the NonCPS context

          Oleg Nenashev added a comment - I have created https://github.com/jenkinsci/pipeline-utility-steps-plugin/pull/46 with test automation for this case. I believe that Remoting works fine, because the latest version of the plugin does method resolution on the master side ( rsandell uses FilePath's stream API for that). So the error likely happens while assigning object to a local variable outside the NonCPS context

          Oleg Nenashev added a comment - - edited

          testuser7 please provide examples of your Pipeline script so that we can reproduce the same issue as you see.

          P.S: I believe that there is no good way to prevent this issue from happening without whitelisting. Probably we should just document that the invocation and result processing must happen within NonCPS. Apparently, the existing unit test does not do that, and it fails randomly. With 5 attempts it passes.

          Oleg Nenashev added a comment - - edited testuser7 please provide examples of your Pipeline script so that we can reproduce the same issue as you see. P.S: I believe that there is no good way to prevent this issue from happening without whitelisting. Probably we should just document that the invocation and result processing must happen within NonCPS. Apparently, the existing unit test does not do that, and it fails randomly. With 5 attempts it passes.

          Oleg Nenashev added a comment -

          I also have discovered JENKINS-50670 during this fix. In Pipeline CPS some types of errors do not seem to be propagated well

          Oleg Nenashev added a comment - I also have discovered JENKINS-50670 during this fix. In Pipeline CPS some types of errors do not seem to be propagated well

          Oleg Nenashev added a comment -

          PR with a "fix" attempt: https://github.com/jenkinsci/pipeline-utility-steps-plugin/pull/46.

          As jglick said, generally it should not be used, but we can make it working within NonCPS if somebody is brave enough

          Oleg Nenashev added a comment - PR with a "fix" attempt: https://github.com/jenkinsci/pipeline-utility-steps-plugin/pull/46 . As jglick said, generally it should not be used, but we can make it working within NonCPS if somebody is brave enough

          Test User added a comment -

          oleg_nenashev Do you still need a pipeline example?

          Test User added a comment - oleg_nenashev Do you still need a pipeline example?

          Oleg Nenashev added a comment -

          I fixed something && clearly understand why this issue may happen. So with this issue I would rather appreciate testing of the https://github.com/jenkinsci/pipeline-utility-steps-plugin/pull/46 pull request (you will still need to run commands in NonCPS there).

          For JENKINS-50632 an info would be useful, because I do not see how to proceed there

          Oleg Nenashev added a comment - I fixed something && clearly understand why this issue may happen. So with this issue I would rather appreciate testing of the https://github.com/jenkinsci/pipeline-utility-steps-plugin/pull/46 pull request (you will still need to run commands in NonCPS there). For JENKINS-50632 an info would be useful, because I do not see how to proceed there

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          Jenkinsfile
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/6c0f385044e8a74f62fab90e7f9d5b8a2064e63e
          Log:
          JENKINS-50633 - Jenkinsfile: Run against tests with JEP-200 by default

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: Jenkinsfile http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/6c0f385044e8a74f62fab90e7f9d5b8a2064e63e Log: JENKINS-50633 - Jenkinsfile: Run against tests with JEP-200 by default

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          pom.xml
          src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStep.java
          src/test/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStepTest.java
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/d82828276e9ba20c96058b5ee5254dce36772537
          Log:
          JENKINS-50633 - Pick up new API in Pipeline: CPS

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: pom.xml src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStep.java src/test/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStepTest.java http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/d82828276e9ba20c96058b5ee5254dce36772537 Log: JENKINS-50633 - Pick up new API in Pipeline: CPS

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/json/ReadJSONStepExecution.java
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/655e6332c88377449d425872891785c35d777305
          Log:
          Merge commit 'bd1bcf86cf76e2f1ce930ab3146e34ed712e7bc2' into jep-200/JENKINS-50633

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/json/ReadJSONStepExecution.java http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/655e6332c88377449d425872891785c35d777305 Log: Merge commit 'bd1bcf86cf76e2f1ce930ab3146e34ed712e7bc2' into jep-200/ JENKINS-50633

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          pom.xml
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/c428ff9ca1e9a1610755fbf1958b3eca7a739df2
          Log:
          JENKINS-50633 - Pick new Parent POM in order to be able to build with 2.107.1 and enforcer

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: pom.xml http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/c428ff9ca1e9a1610755fbf1958b3eca7a739df2 Log: JENKINS-50633 - Pick new Parent POM in order to be able to build with 2.107.1 and enforcer

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          pom.xml
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/7bbfa4427be029be348c5aab509de0851df03c18
          Log:
          JENKINS-50633 - Align Jenkins core requirements with other Pipeline plugins

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: pom.xml http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/7bbfa4427be029be348c5aab509de0851df03c18 Log: JENKINS-50633 - Align Jenkins core requirements with other Pipeline plugins

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStep.java
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/65eeec8e274f9b63a1691c261af447e00ac78f09
          Log:
          JENKINS-50633 - FindBugs

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStep.java http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/65eeec8e274f9b63a1691c261af447e00ac78f09 Log: JENKINS-50633 - FindBugs

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          pom.xml
          src/test/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStepTest.java
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/07fe5f55e2b90e990c427bcdd1da91f1ca246ec5
          Log:
          JENKINS-50633 - Pick new snapshot without NonCPS wrapper

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: pom.xml src/test/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStepTest.java http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/07fe5f55e2b90e990c427bcdd1da91f1ca246ec5 Log: JENKINS-50633 - Pick new snapshot without NonCPS wrapper

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          pom.xml
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/9f3d3e1baba183b6bb46616d2a1afcda360177d9
          Log:
          JENKINS-50633 - Bump core requirement to 2.73.1 as suggested by @jglick

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: pom.xml http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/9f3d3e1baba183b6bb46616d2a1afcda360177d9 Log: JENKINS-50633 - Bump core requirement to 2.73.1 as suggested by @jglick

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          pom.xml
          src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStep.java
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/44165d639385cede4367bd4360cbd15339f8542f
          Log:
          JENKINS-50633 - Pick up Pipeline: CPS version with JENKINS-50752

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: pom.xml src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStep.java http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/44165d639385cede4367bd4360cbd15339f8542f Log: JENKINS-50633 - Pick up Pipeline: CPS version with JENKINS-50752

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStep.java
          src/test/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStepTest.java
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/0f038583a0b5e4cbde2dd9ca79b80c1816e4b608
          Log:
          JENKINS-50633 - Remove the non-CPS requirement

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStep.java src/test/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStepTest.java http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/0f038583a0b5e4cbde2dd9ca79b80c1816e4b608 Log: JENKINS-50633 - Remove the non-CPS requirement

          Code changed in jenkins
          User: Oleg Nenashev
          Path:
          Jenkinsfile
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/641fae05694224c823be10e91828d6952128c1b5
          Log:
          JENKINS-50633 - Jenkinsfile should use 2.107.2 with security fixes

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Oleg Nenashev Path: Jenkinsfile http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/641fae05694224c823be10e91828d6952128c1b5 Log: JENKINS-50633 - Jenkinsfile should use 2.107.2 with security fixes

          Code changed in jenkins
          User: Robert Sandell
          Path:
          Jenkinsfile
          pom.xml
          src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStep.java
          src/test/java/org/jenkinsci/plugins/pipeline/utility/steps/conf/mf/ReadManifestStepTest.java
          src/test/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStepTest.java
          http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/777fd44d9976dc0615dec4150db579dff87c07d7
          Log:
          Merge pull request #46 from oleg-nenashev/jep-200/JENKINS-50633

          JENKINS-50633 - Update Pipeline: CPS requirement to 2.48 and run tests against core with JEP-200

          Compare: https://github.com/jenkinsci/pipeline-utility-steps-plugin/compare/bd1bcf86cf76...777fd44d9976
          *NOTE:* This service been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/

          Functionality will be removed from GitHub.com on January 31st, 2019.

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Robert Sandell Path: Jenkinsfile pom.xml src/main/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStep.java src/test/java/org/jenkinsci/plugins/pipeline/utility/steps/conf/mf/ReadManifestStepTest.java src/test/java/org/jenkinsci/plugins/pipeline/utility/steps/maven/WriteMavenPomStepTest.java http://jenkins-ci.org/commit/pipeline-utility-steps-plugin/777fd44d9976dc0615dec4150db579dff87c07d7 Log: Merge pull request #46 from oleg-nenashev/jep-200/ JENKINS-50633 JENKINS-50633 - Update Pipeline: CPS requirement to 2.48 and run tests against core with JEP-200 Compare: https://github.com/jenkinsci/pipeline-utility-steps-plugin/compare/bd1bcf86cf76...777fd44d9976 * NOTE: * This service been marked for deprecation: https://developer.github.com/changes/2018-04-25-github-services-deprecation/ Functionality will be removed from GitHub.com on January 31st, 2019.

          Oleg Nenashev added a comment -

          Fix released in 2.1.0

          Oleg Nenashev added a comment - Fix released in 2.1.0

          Hello, 

          still a problem ?

          I have on startup log:

          juin 05, 2018 11:04:45 AM jenkins.security.ClassFilterImpl lambda$isBlacklisted$1
          WARNING: org.apache.maven.artifact.versioning.DefaultArtifactVersion in file:/XXX/jenkins2/plugins/maven-plugin/WEB-INF/lib/*+maven-artifact-3.1.0.jar+* might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/

           

          Jenkins version : (LTS) 2.107.3

          pipeline utility steps version : 2.1

          pipeline maven integration plugin : 3.5.7

          (all others plugin up-to-date)

           

          Regards,

           

           

          Valéry FREBOURG added a comment - Hello,  still a problem ? I have on startup log: juin 05, 2018 11:04:45 AM jenkins.security.ClassFilterImpl lambda$isBlacklisted$1 WARNING: org.apache.maven.artifact.versioning.DefaultArtifactVersion in file:/XXX/jenkins2/plugins/maven-plugin/WEB-INF/lib/*+maven-artifact-3.1.0.jar+* might be dangerous, so rejecting; see https://jenkins.io/redirect/class-filter/   Jenkins version : (LTS) 2.107.3 pipeline utility steps version : 2.1 pipeline maven integration plugin : 3.5.7 (all others plugin up-to-date)   Regards,    

          Oleg Nenashev added a comment - - edited

          Maybe another plugin? Please provide a full stacktrace in a new ticket

          Oleg Nenashev added a comment - - edited Maybe another plugin? Please provide a full stacktrace in a new ticket

          Jesse Glick added a comment -

          Best to treat the readMavenPom and writeMavenPom steps as deprecated. Do not use. There are command-line mvn equivalents.

          Jesse Glick added a comment - Best to treat the readMavenPom and writeMavenPom steps as deprecated. Do not use. There are command-line mvn equivalents.

          Robin Smith added a comment -

          jglick if these methods are to be treated as deprecated, could this be marked as such in the Pipeline Utility Steps plugin documentation? And/or in the code on GitHub?

          Robin Smith added a comment - jglick if these methods are to be treated as deprecated, could this be marked as such in the Pipeline Utility Steps plugin documentation ? And/or in the code on GitHub?

          Jesse Glick added a comment -

          Jesse Glick added a comment - robin_smith trying. https://github.com/jenkinsci/pipeline-utility-steps-plugin/pull/47

          Robin Smith added a comment -

          Thanks jglick. It would be great to have that in the docs too - I suppose that will happen after the PR is merged.

          Robin Smith added a comment - Thanks jglick . It would be great to have that in the docs too - I suppose that will happen after the PR is merged.

            oleg_nenashev Oleg Nenashev
            testuser7 Test User
            Votes:
            1 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: