Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-68443

HTTP POST of hpi files to pluginManager causes ArrayOutOfBoundException

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Minor Minor
    • core
    • None
    • Jenkins: 2.332 - Jenkins 2.346
      OS: Linux - 5.15.0-27-generic

      In the past years we were able to successfully automate plugin installation by HTTP POSTing `hpi` files to jenkins instances (via `curl`).

      Starting with version 2.332 this now returns an HTTP 500, caused by an `IndexOutOfBoundsException` (full stack trace bellow). We first recognized this issue in 2.332. We're positive it did not occurr in 2.289.3. This issue still persists in the current version 2.346.

      Ironically, uploading the plugin via Jenkins' web interface still works. I even analyzed the HTTP packages on the wire but could not see what difference there is between success via Web UI and failure using curl. I also tried HTTPie, which also fails.

      For reference: Where and why do we do this, see also github.com/cloudogu/gitops-playground#86

      The issue can be reproduced like so:

       

      docker run --name jenkins -p 8080:8080 -v jenkins_home:/var/jenkins_home jenkins/jenkins:2.346-jdk11
      
      docker exec jenkins cat /var/jenkins_home/secrets/initialAdminPassword
      # Go to localhost:8080
      # Init admin user with admin:admin; Not necessary to install any plugins
      
      # Download some plugin for testing
      wget -P/tmp http://updates.jenkins-ci.org/download/plugins/ace-editor/1.1/ace-editor.hpi
      
      curl -s \
        -H Jenkins-Crumb:$(curl -s --cookie-jar /tmp/cookies --retry 3 --retry-delay 1 -u admin:admin --write-out '%{json}' http://localhost:8080/crumbIssuer/api/json |  jq -rsc '(.[0] | .crumb)') \
        --cookie /tmp/cookies -u admin:admin --fail -L -o /dev/null --write-out '%{http_code}' '-F file=@/tmp/ace-editor.hpi' \
        http://localhost:8080/pluginManager/uploadPlugin
      
      docker logs jenkins

      Full stack trace:

       

      2022-05-09 11:55:53.535+0000 [id=16]    WARNING h.i.i.InstallUncaughtExceptionHandler#handleException: Caught unhandled exception with ID b3a78aea-ec6a-4e95-93a0-4c2d729b7862
      java.lang.IndexOutOfBoundsException: Index 1 out of bounds for length 1
              at java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:64)
              at java.base/jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Preconditions.java:70)
              at java.base/jdk.internal.util.Preconditions.checkIndex(Preconditions.java:248)
              at java.base/java.util.Objects.checkIndex(Objects.java:372)
              at java.base/java.util.ArrayList.get(ArrayList.java:459)
              at hudson.PluginManager.doUploadPlugin(PluginManager.java:1807)
              at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:710)
              at org.kohsuke.stapler.Function$MethodFunction.invoke(Function.java:397)
              at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:409)
              at org.kohsuke.stapler.interceptor.RequirePOST$Processor.invoke(RequirePOST.java:78)
              at org.kohsuke.stapler.PreInvokeInterceptedFunction.invoke(PreInvokeInterceptedFunction.java:26)
              at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:207)
              at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:140)
              at org.kohsuke.stapler.MetaClass$11.doDispatch(MetaClass.java:558)
              at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:59)
              at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:766)
      Caused: javax.servlet.ServletException
              at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:816)
              at org.kohsuke.stapler.Stapler.invoke(Stapler.java:898)
              at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:172)
              at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:59)
              at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:766)
              at org.kohsuke.stapler.Stapler.invoke(Stapler.java:898)
              at org.kohsuke.stapler.Stapler.invoke(Stapler.java:694)
              at org.kohsuke.stapler.Stapler.service(Stapler.java:240)
              at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
              at org.eclipse.jetty.servlet.ServletHolder.handle(ServletHolder.java:799)
              at org.eclipse.jetty.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1631)
              at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:157)
              at jenkins.security.ResourceDomainFilter.doFilter(ResourceDomainFilter.java:81)
              at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:154)
              at jenkins.telemetry.impl.UserLanguages$AcceptLanguageFilter.doFilter(UserLanguages.java:129)
              at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:154)
              at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:160)
              at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
              at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
              at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:154)
              at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
              at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
              at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:94)
              at jenkins.security.AcegiSecurityExceptionFilter.doFilter(AcegiSecurityExceptionFilter.java:52)
              at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:99)
              at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:54)
              at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:99)
              at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:122)
              at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:116)
              at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:99)
              at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:109)
              at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:99)
              at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:102)
              at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:93)
              at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:99)
              at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:219)
              at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:213)
              at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:99)
              at jenkins.security.BasicHeaderProcessor.success(BasicHeaderProcessor.java:139)
              at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:86)
              at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:99)
              at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110)
              at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80)
              at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:63)
              at hudson.security.ChainedServletFilter$1.doFilter(ChainedServletFilter.java:99)
              at hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:111)
              at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:172)
              at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
              at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
              at org.kohsuke.stapler.compression.CompressionFilter.doFilter(CompressionFilter.java:53)
              at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
              at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
              at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:86)
              at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
              at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
              at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:30)
              at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
              at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
              at jenkins.security.SuspiciousRequestFilter.doFilter(SuspiciousRequestFilter.java:38)
              at org.eclipse.jetty.servlet.FilterHolder.doFilter(FilterHolder.java:193)
              at org.eclipse.jetty.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1601)
              at org.eclipse.jetty.servlet.ServletHandler.doHandle(ServletHandler.java:548)
              at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:143)
              at org.eclipse.jetty.security.SecurityHandler.handle(SecurityHandler.java:571)
              at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
              at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:235)
              at org.eclipse.jetty.server.session.SessionHandler.doHandle(SessionHandler.java:1624)
              at org.eclipse.jetty.server.handler.ScopedHandler.nextHandle(ScopedHandler.java:233)
              at org.eclipse.jetty.server.handler.ContextHandler.doHandle(ContextHandler.java:1440)
              at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:188)
              at org.eclipse.jetty.servlet.ServletHandler.doScope(ServletHandler.java:501)
              at org.eclipse.jetty.server.session.SessionHandler.doScope(SessionHandler.java:1594)
              at org.eclipse.jetty.server.handler.ScopedHandler.nextScope(ScopedHandler.java:186)
              at org.eclipse.jetty.server.handler.ContextHandler.doScope(ContextHandler.java:1355)
              at org.eclipse.jetty.server.handler.ScopedHandler.handle(ScopedHandler.java:141)
              at org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:127)
              at org.eclipse.jetty.server.Server.handle(Server.java:516)
              at org.eclipse.jetty.server.HttpChannel.lambda$handle$1(HttpChannel.java:487)
              at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:732)
              at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:479)
              at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:277)
              at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:311)
              at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
              at org.eclipse.jetty.io.ChannelEndPoint$1.run(ChannelEndPoint.java:104)
              at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.runTask(EatWhatYouKill.java:338)
              at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.doProduce(EatWhatYouKill.java:315)
              at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.tryProduce(EatWhatYouKill.java:173)
              at org.eclipse.jetty.util.thread.strategy.EatWhatYouKill.run(EatWhatYouKill.java:131)
              at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:409)
              at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:883)
              at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1034)
              at java.base/java.lang.Thread.run(Thread.java:829) 

       

       

       

            Unassigned Unassigned
            jschnatterer Johannes Schnatterer
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated: