Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-64655

SECURITY-1452 regression: UnsupportedOperationException in jenkins.util.VirtualFile.zip when downloading artifacts from pluggable storage

    • 2.276

      Jenkins shows an "Oops! A problem occurred while processing the request." page every time I click the "(all files in zip)" link to download artifacts. The URL format is like "https://{server}/jenkins/job/{folder}/job/{multibranch-project}/job/{branch}/{build-number}/artifact/*zip*/.zip". The artifacts are stored with Compress Artifacts Plugin.

      The stack trace in the log shows an UnsupportedOperationException from VirtualFile.zip (source), which was added for SECURITY-1452. The same commit also added an override at VirtualFile.FilePathVF.zip, which would not throw this exception, but Compress Artifacts Plugin and other artifact manager plugins define classes that extend VirtualFile rather than VirtualFile.FilePathVF.

      tammikuuta 18, 2021 12:46:26 IP. WARNING hudson.init.impl.InstallUncaughtExceptionHandler handleException
      
      Caught unhandled exception with ID 8004672b-68d5-4bfa-a9a0-1282420e7540
      java.lang.UnsupportedOperationException: Not implemented.
      	at jenkins.util.VirtualFile.zip(VirtualFile.java:342)
      	at hudson.model.DirectoryBrowserSupport.serveFile(DirectoryBrowserSupport.java:254)
      	at hudson.model.DirectoryBrowserSupport.generateResponse(DirectoryBrowserSupport.java:156)
      	at org.kohsuke.stapler.HttpResponseRenderer$Default.handleHttpResponse(HttpResponseRenderer.java:124)
      	at org.kohsuke.stapler.HttpResponseRenderer$Default.generateResponse(HttpResponseRenderer.java:69)
      	at org.kohsuke.stapler.Function.renderResponse(Function.java:164)
      	at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:147)
      	at org.kohsuke.stapler.MetaClass$11.doDispatch(MetaClass.java:536)
      	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)
      	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:766)
      	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:898)
      	at org.kohsuke.stapler.MetaClass$2.doDispatch(MetaClass.java:220)
      	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)
      	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:766)
      	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:898)
      	at org.kohsuke.stapler.MetaClass$4.doDispatch(MetaClass.java:281)
      	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)
      	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:766)
      	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:898)
      	at org.kohsuke.stapler.MetaClass$4.doDispatch(MetaClass.java:281)
      	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)
      	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:766)
      	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:898)
      	at org.kohsuke.stapler.MetaClass$4.doDispatch(MetaClass.java:281)
      	at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:58)
      	at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:766)
      	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:898)
      	at org.kohsuke.stapler.Stapler.invoke(Stapler.java:694)
      	at org.kohsuke.stapler.Stapler.service(Stapler.java:240)
      	at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
      	at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:763)
      	at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1633)
      	at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:154)
      	at jenkins.security.ResourceDomainFilter.doFilter(ResourceDomainFilter.java:76)
      	at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:151)
      	at jenkins.telemetry.impl.UserLanguages$AcceptLanguageFilter.doFilter(UserLanguages.java:129)
      	at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:151)
      	at com.atlassian.bitbucket.jenkins.internal.applink.oauth.serviceprovider.auth.OAuth1aRequestFilter.doFilter(OAuth1aRequestFilter.java:114)
      	at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:151)
      	at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:157)
      	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
      	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1609)
      	at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:159)
      	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
      	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1609)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:84)
      	at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:51)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at jenkins.security.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:125)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:142)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:271)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:93)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:249)
      	at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:67)
      	at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:87)
      	at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:90)
      	at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:171)
      	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
      	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1609)
      	at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:51)
      	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
      	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1609)
      	at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:82)
      	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
      	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1609)
      	at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)
      	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
      	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1609)
      	at jenkins.security.SuspiciousRequestFilter.doFilter(SuspiciousRequestFilter.java:36)
      	at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
      	at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1609)
      	at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:561)
      	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
      	at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:578)
      	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
      	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
      	at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1612)
      	at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
      	at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1434)
      	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
      	at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501)
      	at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1582)
      	at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
      	at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1349)
      	at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
      	at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
      	at org.eclipse.jetty.server.Server.handle(Server.java:516)
      	at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:383)
      	at org.eclipse.jetty.server.HttpChannel$$Lambda$96/000000000000000000.dispatch(Unknown Source)
      	at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:556)
      	at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:375)
      	at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:273)
      	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
      	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
      	at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104)
      	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:773)
      	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:905)
      	at java.lang.Thread.run(Thread.java:823)
      

          [JENKINS-64655] SECURITY-1452 regression: UnsupportedOperationException in jenkins.util.VirtualFile.zip when downloading artifacts from pluggable storage

          Kalle Niemitalo added a comment - I guess this issue will affect all artifact manager plugins: Artifact Manager on S3 : JCloudsVirtualFile.java Azure Artifact Manager : AzureAbstractVirtualFile.java Compress Artifacts : ZipStorage.java Qiniu : QiniuFile.java

          Oleg Nenashev added a comment -

          This is the Jenkins core regression after the SECURITY-1452 fix. https://github.com/jenkinsci/jenkins/commit/71d2ecf1a4e5303e80815eaa3935c4f2fa3d9104 added a new method which is not implemented for Artifact Storage Implementations

          Oleg Nenashev added a comment - This is the Jenkins core regression after the SECURITY-1452 fix. https://github.com/jenkinsci/jenkins/commit/71d2ecf1a4e5303e80815eaa3935c4f2fa3d9104  added a new method which is not implemented for Artifact Storage Implementations

          Can this be fixed just in core or will the fix require new versions of plugins as well?

          Kalle Niemitalo added a comment - Can this be fixed just in core or will the fix require new versions of plugins as well?

          Oleg Nenashev added a comment -

          Presumably, just the core. It might require a default and not so efficient implementation though

          Oleg Nenashev added a comment - Presumably, just the core. It might require a default and not so efficient implementation though

          FYI default implementation will be provided soon-ish in core, currently ensuring it's working correctly (testing with some external storage)

          Wadeck Follonier added a comment - FYI default implementation will be provided soon-ish in core, currently ensuring it's working correctly (testing with some external storage)

          Wadeck Follonier added a comment - PR proposed: https://github.com/jenkinsci/jenkins/pull/5191

          Daniel Beck added a comment -

          2.276 will contain a fix; it's currently being released and should be available in the next few hours.

          Daniel Beck added a comment - 2.276 will contain a fix; it's currently being released and should be available in the next few hours.

          I see the fix was backported to the stable-2.263 branch in https://github.com/jenkinsci/jenkins/pull/5193. Is 2.263.3 intended to be released in February?

          Kalle Niemitalo added a comment - I see the fix was backported to the stable-2.263 branch in https://github.com/jenkinsci/jenkins/pull/5193 . Is 2.263.3 intended to be released in February?

          Oleg Nenashev added a comment -

          There is a plan to do an out-of-order LTS release soon (this week?)

          Stay tuned for updates

          Oleg Nenashev added a comment - There is a plan to do an out-of-order LTS release soon (this week?) Stay tuned for updates

          kon Hello, IIUC current expectation is to have a 2.263.3 released between tomorrow and after tomorrow due to the regressions.

          Wadeck Follonier added a comment - kon Hello, IIUC current expectation is to have a 2.263.3 released between tomorrow and after tomorrow due to the regressions.

            wfollonier Wadeck Follonier
            kon Kalle Niemitalo
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Created:
              Updated:
              Resolved: