• Type: Bug
• Resolution: Cannot Reproduce
• Priority: Minor
• Component/s: jenkins-test-harness
• Labels:

  • JEP-200

[JENKINS-55240] Refusing to marshal org.jvnet.hudson.test.TestCrumbIssuer for security reasons

Carlos Sanchez created issue - 2018-12-18 12:33

Oleg Nenashev made changes - 2018-12-18 12:37

Component/s		New: jenkins-test-harness [ 21462 ]
Component/s	Original: core [ 15593 ]

Collapse comment: René Scheibe added a comment - 2019-01-02 12:10, Edited by René Scheibe - 2019-01-02 19:02

René Scheibe added a comment - 2019-01-02 12:10 - edited

I am a bit confused - the TestCrumbIssuer contained in the issue title is not contained in the provided stacktrace. Why is that?

Expand comment: René Scheibe added a comment - 2019-01-02 12:10, Edited by René Scheibe - 2019-01-02 19:02

René Scheibe added a comment - 2019-01-02 12:10 - edited I am a bit confused - the TestCrumbIssuer contained in the issue title is not contained in the provided stacktrace. Why is that?

Oleg Nenashev made changes - 2019-05-24 10:26

Description

Original: https://ci.jenkins.io/job/Plugins/job/kubernetes-plugin/job/PR-409/1/testReport/org.csanchez.jenkins.plugins.kubernetes/KubernetesSlaveTest/windows_8___Archive__windows_8____testGetPodRetention/ Discussion in https://github.com/jenkinsci/kubernetes-plugin/pull/409 {code} java.lang.RuntimeException: java.io.IOException: java.lang.RuntimeException: Failed to serialize jenkins.model.Jenkins#clouds for class hudson.model.Hudson at hudson.util.PersistedList._onModified(PersistedList.java:183) at hudson.util.PersistedList.add(PersistedList.java:72) at org.csanchez.jenkins.plugins.kubernetes.KubernetesSlaveTest.testGetPodRetention(KubernetesSlaveTest.java:93) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50) at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12) at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47) at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17) at org.jvnet.hudson.test.JenkinsRule$1.evaluate(JenkinsRule.java:552) at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:298) at org.junit.internal.runners.statements.FailOnTimeout$CallableStatement.call(FailOnTimeout.java:292) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.lang.Thread.run(Thread.java:748) Caused by: java.io.IOException: java.lang.RuntimeException: Failed to serialize jenkins.model.Jenkins#clouds for class hudson.model.Hudson at hudson.XmlFile.write(XmlFile.java:200) at jenkins.model.Jenkins.save(Jenkins.java:3221) at hudson.util.PersistedList.onModified(PersistedList.java:173) at jenkins.model.Jenkins$CloudList.onModified(Jenkins.java:501) at hudson.util.PersistedList._onModified(PersistedList.java:181) ... 15 more Caused by: java.lang.RuntimeException: Failed to serialize jenkins.model.Jenkins#clouds for class hudson.model.Hudson at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:256) at hudson.util.RobustReflectionConverter$2.visit(RobustReflectionConverter.java:224) at com.thoughtworks.xstream.converters.reflection.PureJavaReflectionProvider.visitSerializableFields(PureJavaReflectionProvider.java:138) at hudson.util.RobustReflectionConverter.doMarshal(RobustReflectionConverter.java:209) at hudson.util.RobustReflectionConverter.marshal(RobustReflectionConverter.java:150) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43) at com.thoughtworks.xstream.core.TreeMarshaller.start(TreeMarshaller.java:82) at com.thoughtworks.xstream.core.AbstractTreeMarshallingStrategy.marshal(AbstractTreeMarshallingStrategy.java:37) at com.thoughtworks.xstream.XStream.marshal(XStream.java:1026) at com.thoughtworks.xstream.XStream.marshal(XStream.java:1015) at com.thoughtworks.xstream.XStream.toXML(XStream.java:988) at hudson.XmlFile.write(XmlFile.java:193) ... 19 more Caused by: java.lang.UnsupportedOperationException: Refusing to marshal org.csanchez.jenkins.plugins.kubernetes.KubernetesCloud for security reasons; see https://jenkins.io/redirect/class-filter/ at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:543) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:43) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:88) at com.thoughtworks.xstream.converters.collections.AbstractCollectionConverter.writeItem(AbstractCollectionConverter.java:64) at hudson.util.DescribableList$ConverterImpl.marshal(DescribableList.java:269) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84) at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265) at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252) ... 32 more {code}

New: {code:java} Caused by: java.lang.UnsupportedOperationException: Refusing to marshal org.jvnet.hudson.test.TestCrumbIssuer for security reasons; see https://jenkins.io/redirect/class-filter/ at hudson.util.XStream2$BlacklistedTypesConverter.marshal(XStream2.java:546) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller.convert(AbstractReferenceMarshaller.java:69) at com.thoughtworks.xstream.core.TreeMarshaller.convertAnother(TreeMarshaller.java:58) at com.thoughtworks.xstream.core.AbstractReferenceMarshaller$1.convertAnother(AbstractReferenceMarshaller.java:84) at hudson.util.RobustReflectionConverter.marshallField(RobustReflectionConverter.java:265) at hudson.util.RobustReflectionConverter$2.writeField(RobustReflectionConverter.java:252) ... 39 more {code}

Collapse comment: Oleg Nenashev added a comment - 2019-05-24 10:29

Oleg Nenashev added a comment - 2019-05-24 10:29

Removed the confusing description. IIUc the issue is still there, abhyudaya has hit it recently in Role Strategy plugin tests.

My suggestion would be to whitelist the serialization in the entire JTH library to avoid such issues in the future. We just need to add "Jenkins-ClassFilter-Whitelisted=true" to the manifest (https://jenkins.io/blog/2018/01/13/jep-200/#making-plugins-compatible-with-jenkins-2-102-or-above). WDYT jglick?

 

Expand comment: Oleg Nenashev added a comment - 2019-05-24 10:29

Oleg Nenashev added a comment - 2019-05-24 10:29 Removed the confusing description. IIUc the issue is still there, abhyudaya has hit it recently in Role Strategy plugin tests. My suggestion would be to whitelist the serialization in the entire JTH library to avoid such issues in the future. We just need to add "Jenkins-ClassFilter-Whitelisted=true" to the manifest ( https://jenkins.io/blog/2018/01/13/jep-200/#making-plugins-compatible-with-jenkins-2-102-or-above ). WDYT  jglick ?  

Collapse comment: Jesse Glick added a comment - 2019-06-03 18:10

Jesse Glick added a comment - 2019-06-03 18:10

As per this logic it should not be necessary. Is there a specific way to reproduce this error?

Expand comment: Jesse Glick added a comment - 2019-06-03 18:10

Jesse Glick added a comment - 2019-06-03 18:10 As per this logic it should not be necessary. Is there a specific way to reproduce this error?

Collapse comment: Jesse Glick added a comment - 2021-03-03 12:46

Jesse Glick added a comment - 2021-03-03 12:46

Guess not.

Expand comment: Jesse Glick added a comment - 2021-03-03 12:46

Jesse Glick added a comment - 2021-03-03 12:46 Guess not.

Jesse Glick made changes - 2021-03-03 12:46

Resolution		New: Cannot Reproduce [ 5 ]
Status	Original: Open [ 1 ]	New: Resolved [ 5 ]