Skip to content

[JENKINS-42556] PlaceholderTask.runForDisplay vulnerable to AccessDeniedException #21917

Closed
Bug
Closed
[JENKINS-42556] PlaceholderTask.runForDisplay vulnerable to AccessDeniedException#21917
Bug
Labels
component:corecomponent:workflow-durable-task-step-pluginimported-jira-issuepriority:majorresolution:fixed

Description

@jenkins-infra-bot
jenkins-infra-bot
opened on Mar 7, 2017
Resuming build at ... after Jenkins restart
[Pipeline] End of Pipeline
java.io.IOException: Failed to load build state
	at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution$3.onSuccess(CpsFlowExecution.java:610)
	at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution$3.onSuccess(CpsFlowExecution.java:608)
	at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution$4$1.run(CpsFlowExecution.java:651)
	at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$1.run(CpsVmExecutorService.java:35)
	at ...
Caused by: org.acegisecurity.AccessDeniedException: Please login to access job ...
	at jenkins.model.Jenkins.getItem(Jenkins.java:2724)
	at jenkins.model.Jenkins.getItem(Jenkins.java:324)
	at jenkins.model.Jenkins.getItemByFullName(Jenkins.java:2830)
	at hudson.model.Run.fromExternalizableId(Run.java:2314)
	at org.jenkinsci.plugins.workflow.support.steps.ExecutorStepExecution$PlaceholderTask.runForDisplay(ExecutorStepExecution.java:385)
	at org.jenkinsci.plugins.workflow.support.steps.ExecutorStepExecution$PlaceholderTask.getDisplayName(ExecutorStepExecution.java:398)
	at org.jenkinsci.plugins.workflow.support.steps.ExecutorStepExecution$PlaceholderTask.getFullDisplayName(ExecutorStepExecution.java:407)
	at org.jenkinsci.plugins.workflow.support.pickles.ExecutorPickle$1.printWaitingMessage(ExecutorPickle.java:116)
	at org.jenkinsci.plugins.workflow.support.pickles.TryRepeatedly$1.run(TryRepeatedly.java:95)
	at ...

Presumably there is no anonymous read access, and the Timer thread used by TryRepeatedly neglected to impersonate SYSTEM.

Originally reported by jglick, imported from: PlaceholderTask.runForDisplay vulnerable to AccessDeniedException
  • assignee: jglick
  • status: Resolved
  • priority: Major
  • component(s): core, workflow-durable-task-step-plugin
  • resolution: Fixed
  • resolved: 2017-03-10T00:34:24+00:00
  • votes: 0
  • watchers: 2
  • imported: 2025-11-24
Raw content of original issue 


Resuming build at ... after Jenkins restart
[Pipeline] End of Pipeline
java.io.IOException: Failed to load build state
	at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution$3.onSuccess(CpsFlowExecution.java:610)
	at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution$3.onSuccess(CpsFlowExecution.java:608)
	at org.jenkinsci.plugins.workflow.cps.CpsFlowExecution$4$1.run(CpsFlowExecution.java:651)
	at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$1.run(CpsVmExecutorService.java:35)
	at ...
Caused by: org.acegisecurity.AccessDeniedException: Please login to access job ...
	at jenkins.model.Jenkins.getItem(Jenkins.java:2724)
	at jenkins.model.Jenkins.getItem(Jenkins.java:324)
	at jenkins.model.Jenkins.getItemByFullName(Jenkins.java:2830)
	at hudson.model.Run.fromExternalizableId(Run.java:2314)
	at org.jenkinsci.plugins.workflow.support.steps.ExecutorStepExecution$PlaceholderTask.runForDisplay(ExecutorStepExecution.java:385)
	at org.jenkinsci.plugins.workflow.support.steps.ExecutorStepExecution$PlaceholderTask.getDisplayName(ExecutorStepExecution.java:398)
	at org.jenkinsci.plugins.workflow.support.steps.ExecutorStepExecution$PlaceholderTask.getFullDisplayName(ExecutorStepExecution.java:407)
	at org.jenkinsci.plugins.workflow.support.pickles.ExecutorPickle$1.printWaitingMessage(ExecutorPickle.java:116)
	at org.jenkinsci.plugins.workflow.support.pickles.TryRepeatedly$1.run(TryRepeatedly.java:95)
	at ...





Presumably there is no anonymous read access, and the Timer thread used by TryRepeatedly neglected to impersonate SYSTEM.

Activity

  1. jenkins-infra-bot commented on Mar 7, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 7, 2017
    Author

  2. jenkins-infra-bot commented on Mar 8, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 8, 2017
    Author
    jglick:
    • Original comment link
    • Raw content of original comment: 
      Or rather anonymous DISCOVER access but not READ, an unusual configuration. Reproducible, though see JENKINS-42577 for why reproducing can be tricky.
      


      Perhaps core should impersonate SYSTEM in Timer threads automatically, since this is hardly the first time such a bug has occurred.

    Or rather anonymous DISCOVER access but not READ, an unusual configuration. Reproducible, though see JENKINS-42577 for why reproducing can be tricky.

    Perhaps core should impersonate SYSTEM in Timer threads automatically, since this is hardly the first time such a bug has occurred.

  3. jenkins-infra-bot commented on Mar 9, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 9, 2017
    Author
    jglick:
    • Original comment link
    • Raw content of original comment: 
      After some back and forth I have decided that while TryRepeatedly shares some blame, a fix there does not necessarily suffice, because Queue.Task.getFullDisplayName can be called from other threads.

    After some back and forth I have decided that while TryRepeatedly shares some blame, a fix there does not necessarily suffice, because Queue.Task.getFullDisplayName can be called from other threads.

  4. jenkins-infra-bot
    closed this as completedon Mar 10, 2017

  5. jenkins-infra-bot commented on Mar 11, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 11, 2017
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Jesse Glick
    Path:
    core/src/main/java/hudson/model/Queue.java
    http://jenkins-ci.org/commit/jenkins/0bb69952f715ea80b92285b3a810fb938561e594
    Log:
    JENKINS-42556 Improved logging for Queue.

  6. jenkins-infra-bot commented on Mar 11, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 11, 2017
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Daniel Beck
    Path:
    core/src/main/java/hudson/model/Queue.java
    http://jenkins-ci.org/commit/jenkins/13d85fb805161a94e45d4ac485fb3a84d2c72e1a
    Log:
    Merge pull request #2791 from jglick/Queue-logging-JENKINS-42556

    JENKINS-42556 Improved logging for Queue

    Compare: ea724ab...13d85fb

  7. jenkins-infra-bot commented on Mar 14, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 14, 2017
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Jesse Glick
    Path:
    src/main/java/org/jenkinsci/plugins/workflow/support/pickles/TryRepeatedly.java
    http://jenkins-ci.org/commit/workflow-support-plugin/3c076a7c93717ee7d819eeda82dd91f1be099bde
    Log:
    JENKINS-42556 Handle runtime exceptions from printWaitingMessage.

  8. jenkins-infra-bot commented on Mar 14, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 14, 2017
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Jesse Glick
    Path:
    src/main/java/org/jenkinsci/plugins/workflow/support/pickles/TryRepeatedly.java
    http://jenkins-ci.org/commit/workflow-support-plugin/494446bf5962ff41726818224312079876c2cc70
    Log:
    Merge pull request #32 from jglick/TryRepeatedly-anonDiscover-JENKINS-42556

    JENKINS-42556 Handle runtime exceptions from printWaitingMessage

    Compare: jenkinsci/workflow-support-plugin@6fce277...494446b

  9. jenkins-infra-bot commented on Mar 14, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 14, 2017
    Author
    scm_issue_link:
    • Original comment link
    • Raw content of original comment: 
      Code changed in jenkins
User: Jesse Glick
Path:
 core/src/main/java/jenkins/security/ImpersonatingExecutorService.java
 core/src/main/java/jenkins/security/ImpersonatingScheduledExecutorService.java
 core/src/main/java/jenkins/util/AtmostOneTaskExecutor.java
 core/src/main/java/jenkins/util/InterceptingScheduledExecutorService.java
 core/src/main/java/jenkins/util/Timer.java
http://jenkins-ci.org/commit/jenkins/3f41d563b2d619d892e483055cc3d8f511d11dc1
Log:
  JENKINS-42556 Run more system threads as SYSTEM.

    Code changed in jenkins
    User: Jesse Glick
    Path:
    core/src/main/java/jenkins/security/ImpersonatingExecutorService.java
    core/src/main/java/jenkins/security/ImpersonatingScheduledExecutorService.java
    core/src/main/java/jenkins/util/AtmostOneTaskExecutor.java
    core/src/main/java/jenkins/util/InterceptingScheduledExecutorService.java
    core/src/main/java/jenkins/util/Timer.java
    http://jenkins-ci.org/commit/jenkins/3f41d563b2d619d892e483055cc3d8f511d11dc1
    Log:
    JENKINS-42556 Run more system threads as SYSTEM.

  10. jenkins-infra-bot commented on Mar 14, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 14, 2017
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Jesse Glick
    Path:
    core/src/main/java/jenkins/security/ImpersonatingExecutorService.java
    core/src/main/java/jenkins/security/ImpersonatingScheduledExecutorService.java
    core/src/main/java/jenkins/util/AtmostOneTaskExecutor.java
    core/src/main/java/jenkins/util/InterceptingScheduledExecutorService.java
    core/src/main/java/jenkins/util/Timer.java
    http://jenkins-ci.org/commit/jenkins/dd0d578cb07084366ab4d1a1efdeb1fe39d14688
    Log:
    Merge pull request #2792 from jglick/SYSTEM-JENKINS-42556

    JENKINS-42556 Run more system threads as SYSTEM

    Compare: 12a4177...dd0d578

  11. jenkins-infra-bot commented on Mar 14, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Mar 14, 2017
    Author
    scm_issue_link:

    Code changed in jenkins
    User: Jesse Glick
    Path:
    core/src/main/java/jenkins/security/ImpersonatingExecutorService.java
    core/src/main/java/jenkins/security/ImpersonatingScheduledExecutorService.java
    core/src/main/java/jenkins/util/InterceptingScheduledExecutorService.java
    http://jenkins-ci.org/commit/jenkins/98bb78ff1891bb85471a089977066c4b4a11b261
    Log:
    JENKINS-42556 Updating since tags for #2792.

  12. jenkins-infra-bot commented on Apr 12, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Apr 12, 2017
    Author
    danielbeck:
    • Original comment link
    • Raw content of original comment: 
      jglick Is this a useful LTS candidate?

    jglick Is this a useful LTS candidate?

  13. jenkins-infra-bot commented on Apr 12, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Apr 12, 2017
    Author
    jglick:
    • Original comment link
    • Raw content of original comment: 
      Well…it is relatively risky, and this particular bug symptom has an independent workaround, so I am not sure I would recommend it for backport.

    Well…it is relatively risky, and this particular bug symptom has an independent workaround, so I am not sure I would recommend it for backport.

  14. jenkins-infra-bot commented on Apr 12, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Apr 12, 2017
    Author
    danielbeck:
    • Original comment link
    • Raw content of original comment: 
      Not an LTS candidate then.

    Not an LTS candidate then.

  15. jenkins-infra-bot commented on Sep 28, 2017

    @jenkins-infra-bot
    jenkins-infra-bot
    on Sep 28, 2017
    Author
    jglick:
    • Original comment link
    • Raw content of original comment: 
      Found another effect of this. On 2.46.x (prior to this fix), a Pipeline virtual thread dump like /job/…/…/threadDump/ will show, e.g.,
      


      

      Thread #…
	at DSL.node(node block appears to be neither running nor scheduled)
	at WorkflowScript.run(WorkflowScript:…)

      

      

      when there is a node block waiting in queue but the system has no anonymous read access. This is because ExecutorStepExecution.getStatus checks Queue.getItems, which as of SECURITY-186 is a permission-controlled call, which would in fact work if called under the authentication of the user looking at the thread dump (who presumably has READ on that job); yet StepExecution.getStatusBounded runs inside Timer, thus as anonymous.

    Found another effect of this. On 2.46.x (prior to this fix), a Pipeline virtual thread dump like /job/…/…/threadDump/ will show, e.g.,

    Thread #…
	at DSL.node(node block appears to be neither running nor scheduled)
	at WorkflowScript.run(WorkflowScript:…)

    when there is a node block waiting in queue but the system has no anonymous read access. This is because ExecutorStepExecution.getStatus checks Queue.getItems, which as of SECURITY-186 is a permission-controlled call, which would in fact work if called under the authentication of the user looking at the thread dump (who presumably has READ on that job); yet StepExecution.getStatusBounded runs inside Timer, thus as anonymous.

  16. jenkins-infra-bot
    added
    bugFor changelog: Minor bug. Will be listed after features
    imported-jira-issue
    component:core
    priority:major
    resolution:fixed
    component:workflow-durable-task-step-plugin
    on Nov 24, 2025

  17. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original is_duplicated_by from Jira: JENKINS-42504]

  18. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original relates_to from Jira: JENKINS-42707]

  19. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original relates_to from Jira: JENKINS-63868]

  20. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original relates_to from Jira: JENKINS-50296]

  21. jenkins-infra-bot commented on Nov 24, 2025

    @jenkins-infra-bot
    jenkins-infra-bot
    on Nov 24, 2025
    Author

    [Original epic from Jira: JENKINS-35399]

  22. jenkins-infra-bot
    added the
    Bug
    issue type on Nov 25, 2025
  23. jenkins-infra-bot
    removed
    bugFor changelog: Minor bug. Will be listed after features
    on Nov 25, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    component:corecomponent:workflow-durable-task-step-pluginimported-jira-issuepriority:majorresolution:fixed

    Type

    Bug

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions