Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-26541

Rejected sandbox methods inside parallel not being recorded for approval

    Details

    • Type: Bug
    • Status: Resolved (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Component/s: pipeline
    • Labels:
      None
    • Similar Issues:

      Description

      I tried to run the CD demo in the sandbox and got

      org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use staticMethod java.util.UUID randomUUID
      	at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectStaticMethod(StaticWhitelist.java:164)
      	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onStaticCall(SandboxInterceptor.java:100)
      	at org.kohsuke.groovy.sandbox.impl.Checker$2.call(Checker.java:115)
      	at org.kohsuke.groovy.sandbox.impl.Checker.checkedStaticCall(Checker.java:112)
      	at org.kohsuke.groovy.sandbox.impl.Checker.checkedCall(Checker.java:81)
      	at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.methodCall(SandboxInvoker.java:15)
      	at WorkflowScript.runWithServer(WorkflowScript:47)
      	at WorkflowScript.run(WorkflowScript:16)
      	at Unknown.Unknown(Unknown)
      	at ___cps.transform___(Native Method)
      	at com.cloudbees.groovy.cps.impl.ContinuationGroup.methodCall(ContinuationGroup.java:69)
      

      Fine, but then http://localhost:8081/scriptApproval/ did not list the rejected method. Is SandboxContinuable not calling ScriptApproval.accessRejected?

        Attachments

          Issue Links

            Activity

            Hide
            jglick Jesse Glick added a comment -

            It works normally, but not inside parallel.

            Show
            jglick Jesse Glick added a comment - It works normally, but not inside parallel .
            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Jesse Glick
            Path:
            aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java
            cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java
            http://jenkins-ci.org/commit/workflow-plugin/fb174fdabbb46f9f84ef84a83dcccaa85252713f
            Log:
            [FIXED JENKINS-26541] Need to check for RejectedAccessException wrapped in ParallelStepException.

            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java http://jenkins-ci.org/commit/workflow-plugin/fb174fdabbb46f9f84ef84a83dcccaa85252713f Log: [FIXED JENKINS-26541] Need to check for RejectedAccessException wrapped in ParallelStepException.
            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Jesse Glick
            Path:
            CHANGES.md
            http://jenkins-ci.org/commit/workflow-plugin/d31a8d7b9e6ba7af9dbe238be0e4c2162720b5e3
            Log:
            JENKINS-26541 Noting.

            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: CHANGES.md http://jenkins-ci.org/commit/workflow-plugin/d31a8d7b9e6ba7af9dbe238be0e4c2162720b5e3 Log: JENKINS-26541 Noting.
            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Jesse Glick
            Path:
            CHANGES.md
            aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java
            cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java
            http://jenkins-ci.org/commit/workflow-plugin/b83b89dc448e402d34a7741537f7de675293c5f9
            Log:
            Merge pull request #43 from jenkinsci/RejectedAccessException-parallel-JENKINS-26541

            JENKINS-26541 Handle wrapped RejectedAccessException

            Compare: https://github.com/jenkinsci/workflow-plugin/compare/8f9dc9acc102...b83b89dc448e

            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: CHANGES.md aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java http://jenkins-ci.org/commit/workflow-plugin/b83b89dc448e402d34a7741537f7de675293c5f9 Log: Merge pull request #43 from jenkinsci/RejectedAccessException-parallel- JENKINS-26541 JENKINS-26541 Handle wrapped RejectedAccessException Compare: https://github.com/jenkinsci/workflow-plugin/compare/8f9dc9acc102...b83b89dc448e
            Hide
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Jesse Glick
            Path:
            aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java
            cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java
            http://jenkins-ci.org/commit/workflow-cps-plugin/c99b9570aba68c4ab2952892ec7ec94662b8fd29
            Log:
            [FIXED JENKINS-26541] Need to check for RejectedAccessException wrapped in ParallelStepException.
            Originally-Committed-As: fb174fdabbb46f9f84ef84a83dcccaa85252713f

            Show
            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: aggregator/src/test/java/org/jenkinsci/plugins/workflow/WorkflowJobNonRestartingTest.java cps/src/main/java/org/jenkinsci/plugins/workflow/cps/SandboxContinuable.java http://jenkins-ci.org/commit/workflow-cps-plugin/c99b9570aba68c4ab2952892ec7ec94662b8fd29 Log: [FIXED JENKINS-26541] Need to check for RejectedAccessException wrapped in ParallelStepException. Originally-Committed-As: fb174fdabbb46f9f84ef84a83dcccaa85252713f

              People

              • Assignee:
                jglick Jesse Glick
                Reporter:
                jglick Jesse Glick
              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: