Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-55240

Refusing to marshal org.jvnet.hudson.test.TestCrumbIssuer for security reasons

XMLWordPrintable

      Caused by: java.lang.UnsupportedOperationException: Refusing to marshal org.jvnet.hudson.test.TestCrumbIssuer for security reasons; see https://jenkins.io/redirect/class-filter/ at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:546) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84) at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265) at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252) ... 39 more

          [JENKINS-55240] Refusing to marshal org.jvnet.hudson.test.TestCrumbIssuer for security reasons

          René Scheibe added a comment - - edited

          I am a bit confused - the TestCrumbIssuer contained in the issue title is not contained in the provided stacktrace. Why is that?

          René Scheibe added a comment - - edited I am a bit confused - the TestCrumbIssuer contained in the issue title is not contained in the provided stacktrace. Why is that?

          Oleg Nenashev added a comment -

          Removed the confusing description. IIUc the issue is still there, abhyudaya has hit it recently in Role Strategy plugin tests.

          My suggestion would be to whitelist the serialization in the entire JTH library to avoid such issues in the future. We just need to add "Jenkins-ClassFilter-Whitelisted=true" to the manifest (https://jenkins.io/blog/2018/01/13/jep-200/#making-plugins-compatible-with-jenkins-2-102-or-above). WDYT jglick?

           

          Oleg Nenashev added a comment - Removed the confusing description. IIUc the issue is still there, abhyudaya has hit it recently in Role Strategy plugin tests. My suggestion would be to whitelist the serialization in the entire JTH library to avoid such issues in the future. We just need to add "Jenkins-ClassFilter-Whitelisted=true" to the manifest ( https://jenkins.io/blog/2018/01/13/jep-200/#making-plugins-compatible-with-jenkins-2-102-or-above ). WDYT  jglick ?  

          Jesse Glick added a comment -

          As per this logic it should not be necessary. Is there a specific way to reproduce this error?

          Jesse Glick added a comment - As per this logic it should not be necessary. Is there a specific way to reproduce this error?

          Jesse Glick added a comment -

          Guess not.

          Jesse Glick added a comment - Guess not.

            Unassigned Unassigned
            csanchez Carlos Sanchez
            Votes:
            2 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: