Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-50660

Whitelist: JsonOutput.toJson(Object) not included in generic whitelist

      Currently, you cannot output arrays or lists as JSON in pipeline scripts by default. This is because - unlike almost all other overloads of JsonOutput.toJson - JsonOutput.toJson(Object) is not on the generic whitelist.

      If this method is somehow problematic from a security POV, feel free to explain and close this issue, but I cannot see any reason to disallow this overload. According to the JavaDoc, this is what it does:

      Returns:
      "null" for a null value, or a JSON array representation for a collection, array, iterator or enumeration, or representation for other object.

          [JENKINS-50660] Whitelist: JsonOutput.toJson(Object) not included in generic whitelist

          Andrew Bayer added a comment -

          Seems like a reasonable addition to me - not sure if/when I'll get a chance to open a PR with this change, so feel free to do so yourself!

          Andrew Bayer added a comment - Seems like a reasonable addition to me - not sure if/when I'll get a chance to open a PR with this change, so feel free to do so yourself!

          Tim Bradt added a comment -

          This is still a limitation, and has really brought me up short.  I really need to convert a JSON value to a string, and this method is the best way to do it.  In fact so far I haven't figured out another way so I am jumping through hoops to go the other direction and convert the string to which I want to compare my JSON value to a JSON object.  Would love to see this get whitelisted.

          Tim Bradt added a comment - This is still a limitation, and has really brought me up short.  I really need to convert a JSON value to a string, and this method is the best way to do it.  In fact so far I haven't figured out another way so I am jumping through hoops to go the other direction and convert the string to which I want to compare my JSON value to a JSON object.  Would love to see this get whitelisted.

            Unassigned Unassigned
            mb_o Moritz Baumann
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: