• Icon: Bug Bug
    • Resolution: Fixed
    • Icon: Minor Minor
    • core
    • None
    • 2.318

      Jenkins core uses an extension of the the stock `XStream` class from `xstream` library, that's `Xstream2`. The normal usage in plugins that need to somehow interact with XStream is to use one of the corresponding singletons (Items.XSTREAM or Run.XSTREAM mainly).

      However that's limiting more elaborated usages, because any mutation done to those objects are affecting the entire Jenkins instance, for example, registering a special `ConverterLookup` or `ConverterRegistry`. In order to do that without polluting existing singletons new instances need to be created, but a more powerful `XStream2` constructor is needed matching the superclass one:

      `public XStream(ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver, ClassLoaderReference classLoaderReference, Mapper mapper, ConverterLookup converterLookup, ConverterRegistry converterRegistry)`

      Note: this was not needed before because most of the time `XStream` was just working fine, but since the last update (to `xstream:1.4.18`) the built-in `XStream` security is not suitable for usage inside Jenkins as it will reject most of the classes that are deserialized, so `XStream2` is needed.

      Note2: there is no public usage if this new constructor, for now it is only used in a non-public plugin maintained by CloudBees. The need behind the new constructor is to inject `ConverterLookup` and `ConverterRegistry` (as noted before) to be able to pre-process items and builds XML files when transferring them from one Jenkins instance to another using the Move/Copy/Promote feature.

          [JENKINS-66955] Add XStream2 constructor matching super class

          Antonio Muñiz created issue -
          James Nord made changes -
          Labels New: lts-candidate
          Jesse Glick made changes -
          Status Original: Open [ 1 ] New: In Progress [ 3 ]
          Jesse Glick made changes -
          Status Original: In Progress [ 3 ] New: In Review [ 10005 ]
          Jesse Glick made changes -
          Remote Link New: This issue links to "jenkins PR-5844 (Web Link)" [ 27110 ]
          Antonio Muñiz made changes -
          Description Original: Jenkins core uses an extension of the the stock `XStream` class from `xstream` library, that's `Xstream2`. The normal usage in plugins that need to somehow interact with XStream is to use one of the corresponding singletons (Items.XSTREAM or Run.XSTREAM mainly).

          However that's limiting more elaborated usages, because any mutation done to those objects are affecting the entire Jenkins instance, for example, registering a special `ConverterLookup` or `ConverterRegistry`. In order to do that without polluting existing singletons new instances need to be created, but a more powerful `XStream2` constructor is needed matching the superclass one:

          `public XStream(ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver, ClassLoaderReference classLoaderReference, Mapper mapper, ConverterLookup converterLookup, ConverterRegistry converterRegistry)`

          Note: this was not needed before because most of the time `XStream` was just working fine, but since the last update (to `xstream:1.4.18`) the built-in XStream security is not suitable for usage inside Jenkins, so `XStream2` is needed.
          New: Jenkins core uses an extension of the the stock `XStream` class from `xstream` library, that's `Xstream2`. The normal usage in plugins that need to somehow interact with XStream is to use one of the corresponding singletons (Items.XSTREAM or Run.XSTREAM mainly).

          However that's limiting more elaborated usages, because any mutation done to those objects are affecting the entire Jenkins instance, for example, registering a special `ConverterLookup` or `ConverterRegistry`. In order to do that without polluting existing singletons new instances need to be created, but a more powerful `XStream2` constructor is needed matching the superclass one:

          `public XStream(ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver, ClassLoaderReference classLoaderReference, Mapper mapper, ConverterLookup converterLookup, ConverterRegistry converterRegistry)`

          Note: this was not needed before because most of the time `XStream` was just working fine, but since the last update (to `xstream:1.4.18`) the built-in `XStream` security is not suitable for usage inside Jenkins, so `XStream2` is needed.
          Antonio Muñiz made changes -
          Description Original: Jenkins core uses an extension of the the stock `XStream` class from `xstream` library, that's `Xstream2`. The normal usage in plugins that need to somehow interact with XStream is to use one of the corresponding singletons (Items.XSTREAM or Run.XSTREAM mainly).

          However that's limiting more elaborated usages, because any mutation done to those objects are affecting the entire Jenkins instance, for example, registering a special `ConverterLookup` or `ConverterRegistry`. In order to do that without polluting existing singletons new instances need to be created, but a more powerful `XStream2` constructor is needed matching the superclass one:

          `public XStream(ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver, ClassLoaderReference classLoaderReference, Mapper mapper, ConverterLookup converterLookup, ConverterRegistry converterRegistry)`

          Note: this was not needed before because most of the time `XStream` was just working fine, but since the last update (to `xstream:1.4.18`) the built-in `XStream` security is not suitable for usage inside Jenkins, so `XStream2` is needed.
          New: Jenkins core uses an extension of the the stock `XStream` class from `xstream` library, that's `Xstream2`. The normal usage in plugins that need to somehow interact with XStream is to use one of the corresponding singletons (Items.XSTREAM or Run.XSTREAM mainly).

          However that's limiting more elaborated usages, because any mutation done to those objects are affecting the entire Jenkins instance, for example, registering a special `ConverterLookup` or `ConverterRegistry`. In order to do that without polluting existing singletons new instances need to be created, but a more powerful `XStream2` constructor is needed matching the superclass one:

          `public XStream(ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver, ClassLoaderReference classLoaderReference, Mapper mapper, ConverterLookup converterLookup, ConverterRegistry converterRegistry)`

          Note: this was not needed before because most of the time `XStream` was just working fine, but since the last update (to `xstream:1.4.18`) the built-in `XStream` security is not suitable for usage inside Jenkins as it will reject most of the classes that are deserialized, so `XStream2` is needed.
          Antonio Muñiz made changes -
          Description Original: Jenkins core uses an extension of the the stock `XStream` class from `xstream` library, that's `Xstream2`. The normal usage in plugins that need to somehow interact with XStream is to use one of the corresponding singletons (Items.XSTREAM or Run.XSTREAM mainly).

          However that's limiting more elaborated usages, because any mutation done to those objects are affecting the entire Jenkins instance, for example, registering a special `ConverterLookup` or `ConverterRegistry`. In order to do that without polluting existing singletons new instances need to be created, but a more powerful `XStream2` constructor is needed matching the superclass one:

          `public XStream(ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver, ClassLoaderReference classLoaderReference, Mapper mapper, ConverterLookup converterLookup, ConverterRegistry converterRegistry)`

          Note: this was not needed before because most of the time `XStream` was just working fine, but since the last update (to `xstream:1.4.18`) the built-in `XStream` security is not suitable for usage inside Jenkins as it will reject most of the classes that are deserialized, so `XStream2` is needed.
          New: Jenkins core uses an extension of the the stock `XStream` class from `xstream` library, that's `Xstream2`. The normal usage in plugins that need to somehow interact with XStream is to use one of the corresponding singletons (Items.XSTREAM or Run.XSTREAM mainly).

          However that's limiting more elaborated usages, because any mutation done to those objects are affecting the entire Jenkins instance, for example, registering a special `ConverterLookup` or `ConverterRegistry`. In order to do that without polluting existing singletons new instances need to be created, but a more powerful `XStream2` constructor is needed matching the superclass one:

          `public XStream(ReflectionProvider reflectionProvider, HierarchicalStreamDriver driver, ClassLoaderReference classLoaderReference, Mapper mapper, ConverterLookup converterLookup, ConverterRegistry converterRegistry)`

          Note: this was not needed before because most of the time `XStream` was just working fine, but since the last update (to `xstream:1.4.18`) the built-in `XStream` security is not suitable for usage inside Jenkins as it will reject most of the classes that are deserialized, so `XStream2` is needed.

          Note2: there is no public usage if this new constructor, for now it is only used in a non-public plugin maintained by CloudBees. The need behind the new constructor is to inject `ConverterLookup` and `ConverterRegistry` (as noted before) to be able to pre-process items and builds XML files when transferring them from one Jenkins instance to another using the [Move/Copy/Promote feature|https://docs.cloudbees.com/docs/cloudbees-ci/latest/traditional-admin-guide/move-copy-promote].
          Mark Waite made changes -
          Released As New: 2.318
          Resolution New: Fixed [ 1 ]
          Status Original: In Review [ 10005 ] New: Closed [ 6 ]
          Daniel Beck made changes -
          Issue Type Original: Task [ 3 ] New: Improvement [ 4 ]

            amuniz Antonio Muñiz
            amuniz Antonio Muñiz
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: