[JENKINS-52036] List[Range] operator not permitted in sandbox

Type: Bug
Resolution: Fixed
Priority: Minor
Component/s: script-security-plugin
Labels:
- groovy
- pipeline
Environment:
Jenkins 2.89.3
Pipeline Groovy 2.53
Script Security Plugin 1.44

Similar Issues:
Powered by SuggestiMate

Show

Using the range operator to slice a list (see), even inside a script block, causes the below error:

Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection. Administrators can decide whether to approve or reject this signature.
[Pipeline] End of Pipeline
org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection
        at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectStaticMethod(StaticWhitelist.java:189)
        at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onGetArray(SandboxInterceptor.java:447)
        at org.kohsuke.groovy.sandbox.impl.Checker$10.call(Checker.java:419)
        at org.kohsuke.groovy.sandbox.impl.Checker.checkedGetArray(Checker.java:424)
        at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.getArray(SandboxInvoker.java:45)
        at com.cloudbees.groovy.cps.impl.ArrayAccessBlock.rawGet(ArrayAccessBlock.java:21)
        at WorkflowScript.run(WorkflowScript:15)

To reproduce, use the below pipeline script:

pipeline {
    agent any
    
    stages {
        stage ('Run') {
            steps {
                script {
                    [1, 2, 3][1..2]
                }
            }
        }
    }
}

Hari Dara created issue - 2018-06-19 13:29

Hari Dara made changes - 2018-06-19 13:32

Environment

New: Jenkins 2.89.3
Pipeline Groovy 2.53
Script Security Plugin 1.44

Hari Dara made changes - 2018-06-19 13:33

Description

Original: Using the range operator to slice a list ([see|[http://docs.groovy-lang.org/next/html/documentation/working-with-collections.html#Collections-Slicingwiththesubscriptoperator])], even inside a script block, causes the below error:

{noformat}
Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection. Administrators can decide whether to approve or reject this signature.
[Pipeline] End of Pipeline
org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection
        at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectStaticMethod(StaticWhitelist.java:189)
        at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onGetArray(SandboxInterceptor.java:447)
        at org.kohsuke.groovy.sandbox.impl.Checker$10.call(Checker.java:419)
        at org.kohsuke.groovy.sandbox.impl.Checker.checkedGetArray(Checker.java:424)
        at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.getArray(SandboxInvoker.java:45)
        at com.cloudbees.groovy.cps.impl.ArrayAccessBlock.rawGet(ArrayAccessBlock.java:21)
        at WorkflowScript.run(WorkflowScript:15)
{noformat}

To reproduce, use the below pipeline script:

{noformat}
pipeline {
    agent any

    stages {
        stage ('Run') {
            steps {
                script {
                    [1, 2, 3][1..2]
                }
            }
        }
    }
}
{noformat}

New: Using the range operator to slice a list ([see|[http://docs.groovy-lang.org/next/html/documentation/working-with-collections.html#Collections-Slicingwiththesubscriptoperator]]), even inside a script block, causes the below error:

{noformat}
Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection. Administrators can decide whether to approve or reject this signature.
[Pipeline] End of Pipeline
org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection
        at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectStaticMethod(StaticWhitelist.java:189)
        at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onGetArray(SandboxInterceptor.java:447)
        at org.kohsuke.groovy.sandbox.impl.Checker$10.call(Checker.java:419)
        at org.kohsuke.groovy.sandbox.impl.Checker.checkedGetArray(Checker.java:424)
        at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.getArray(SandboxInvoker.java:45)
        at com.cloudbees.groovy.cps.impl.ArrayAccessBlock.rawGet(ArrayAccessBlock.java:21)
        at WorkflowScript.run(WorkflowScript:15)
{noformat}

To reproduce, use the below pipeline script:

{noformat}
pipeline {
    agent any

    stages {
        stage ('Run') {
            steps {
                script {
                    [1, 2, 3][1..2]
                }
            }
        }
    }
}
{noformat}

Hari Dara made changes - 2018-06-19 13:35

Description

Original: Using the range operator to slice a list ([see|[http://docs.groovy-lang.org/next/html/documentation/working-with-collections.html#Collections-Slicingwiththesubscriptoperator]]), even inside a script block, causes the below error:

{noformat}
Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection. Administrators can decide whether to approve or reject this signature.
[Pipeline] End of Pipeline
org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection
        at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectStaticMethod(StaticWhitelist.java:189)
        at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onGetArray(SandboxInterceptor.java:447)
        at org.kohsuke.groovy.sandbox.impl.Checker$10.call(Checker.java:419)
        at org.kohsuke.groovy.sandbox.impl.Checker.checkedGetArray(Checker.java:424)
        at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.getArray(SandboxInvoker.java:45)
        at com.cloudbees.groovy.cps.impl.ArrayAccessBlock.rawGet(ArrayAccessBlock.java:21)
        at WorkflowScript.run(WorkflowScript:15)
{noformat}

To reproduce, use the below pipeline script:

{noformat}
pipeline {
    agent any

    stages {
        stage ('Run') {
            steps {
                script {
                    [1, 2, 3][1..2]
                }
            }
        }
    }
}
{noformat}

New: Using the range operator to slice a list ([see|http://docs.groovy-lang.org/next/html/documentation/working-with-collections.html#Collections-Slicingwiththesubscriptoperator]), even inside a script block, causes the below error:

{noformat}
Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection. Administrators can decide whether to approve or reject this signature.
[Pipeline] End of Pipeline
org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use staticMethod org.codehaus.groovy.runtime.DefaultGroovyMethods getAt java.util.List java.util.Collection
        at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectStaticMethod(StaticWhitelist.java:189)
        at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onGetArray(SandboxInterceptor.java:447)
        at org.kohsuke.groovy.sandbox.impl.Checker$10.call(Checker.java:419)
        at org.kohsuke.groovy.sandbox.impl.Checker.checkedGetArray(Checker.java:424)
        at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.getArray(SandboxInvoker.java:45)
        at com.cloudbees.groovy.cps.impl.ArrayAccessBlock.rawGet(ArrayAccessBlock.java:21)
        at WorkflowScript.run(WorkflowScript:15)
{noformat}

To reproduce, use the below pipeline script:

{noformat}
pipeline {
    agent any

    stages {
        stage ('Run') {
            steps {
                script {
                    [1, 2, 3][1..2]
                }
            }
        }
    }
}
{noformat}

jang hyemi (Inactive) made changes - 2018-06-22 00:45

Status

Original: Open [ 1 ]

New: In Progress [ 3 ]

jang hyemi (Inactive) made changes - 2018-06-22 03:45

Status

Original: In Progress [ 3 ]

New: In Review [ 10005 ]

jang hyemi (Inactive) made changes - 2018-06-22 03:45

Resolution		New: Fixed [ 1 ]
Status	Original: In Review [ 10005 ]	New: Closed [ 6 ]

jang hyemi (Inactive) made changes - 2018-06-22 03:47

Status

Original: Closed [ 6 ]

New: In Review [ 10005 ]

jang hyemi (Inactive) made changes - 2018-06-22 03:47

Status

Original: In Review [ 10005 ]

New: Closed [ 6 ]

jang hyemi (Inactive) made changes - 2018-06-22 03:48

Status

Original: Closed [ 6 ]

New: In Review [ 10005 ]

jang hyemi (Inactive) made changes - 2018-06-22 03:48

Status

Original: In Review [ 10005 ]

New: Closed [ 6 ]

Assignee:: Andrew Bayer

Reporter:: Hari Dara

Votes:: 0 Vote for this issue

Watchers:: 2 Start watching this issue

Created:: 2018-06-19 13:29

Updated:: 2018-08-21 10:07

Resolved:: 2018-06-22 03:45

Jenkins

Details

Description

Attachments

Activity

People

Dates