[JENKINS-47736] JEP-200: Switch Remoting/XStream blacklist to a whitelist #22391

Activity

1. jenkins-infra-bot commented on Oct 30, 2017

   

   jenkins-infra-bot

   on Oct 30, 2017

   Author

   More actions

   • Remote links associated with this issue:

     • remoting PR 208
     • jenkins-test-harness PR 81
     • core PR 3120
     • dockerhub-notification PR 16
     • JEP 200
     • cloudbees-folder PR 116
     • CloudBees Internal OSS-2508
     • credentials PR 96
     • parameterized-trigger PR 118
     • workflow-cps PR 190
     • pipeline-build-step PR 17
     • copyartifact PR 97
     • workflow-support PR 50
     • git-client PR 290
     • job-dsl PR 1092
     • lib-jenkins-maven-embedder PR 15
     • Wiki Page with the list of affected plugins
     • xtrigger-lib PR 9
     • monitoring PR 6
     • ruby-runtime PR 5
     • priority-sorter PR 42
     • project-description-setter PR 2
     • publish-over PR 8
     • dependency-check PR 20
     • saltstack PR 116
     • nexus-platform PR 16
     • kubernetes-pipeline PR 66
     • crx-content-package-deployer PR 8
2. jenkins-infra-bot commented on Oct 30, 2017

   

   jenkins-infra-bot

   on Oct 30, 2017

   Author

   More actions

   jglick:

   • Original comment link
   • Raw content of original comment:

     I filed a JEP which should be referred to for all details.
     

   I filed a JEP which should be referred to for all details.
3. jenkins-infra-bot commented on Oct 31, 2017

   

   jenkins-infra-bot

   on Oct 31, 2017

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: Jesse Glick
     Path:
      src/main/java/org/jenkinsci/plugins/registry/notification/webhook/dockerregistry/DockerRegistryWebHookPayload.java
     http://jenkins-ci.org/commit/dockerhub-notification-plugin/162947aa5d4267fbb25ea8528c4fcdf2186eb31e
     Log:
       JENKINS-47736 Unnecessary serialization of a JSONObject.
     
     
     

   Code changed in jenkins
   User: Jesse Glick
   Path:
   src/main/java/org/jenkinsci/plugins/registry/notification/webhook/dockerregistry/DockerRegistryWebHookPayload.java
   http://jenkins-ci.org/commit/dockerhub-notification-plugin/162947aa5d4267fbb25ea8528c4fcdf2186eb31e
   Log:
   JENKINS-47736 Unnecessary serialization of a JSONObject.
4. jenkins-infra-bot commented on Oct 31, 2017

   

   jenkins-infra-bot

   on Oct 31, 2017

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: Jesse Glick
     Path:
      src/main/java/org/jenkinsci/plugins/registry/notification/webhook/dockerregistry/DockerRegistryWebHookPayload.java
     http://jenkins-ci.org/commit/dockerhub-notification-plugin/9641b4f4d9d416119f9bc803a132994a9278340d
     Log:
       Merge pull request #16 from jglick/whitelist-JENKINS-47736
     
     JENKINS-47736 Unnecessary serialization of a JSONObject
     
     
     Compare: jenkinsci/dockerhub-notification-plugin@5932021...9641b4f
     
     

   Code changed in jenkins
   User: Jesse Glick
   Path:
   src/main/java/org/jenkinsci/plugins/registry/notification/webhook/dockerregistry/DockerRegistryWebHookPayload.java
   http://jenkins-ci.org/commit/dockerhub-notification-plugin/9641b4f4d9d416119f9bc803a132994a9278340d
   Log:
   Merge pull request #16 from jglick/whitelist-JENKINS-47736

   JENKINS-47736 Unnecessary serialization of a JSONObject

   Compare: jenkinsci/dockerhub-notification-plugin@5932021...9641b4f
5. jenkins-infra-bot commented on Nov 1, 2017

   

   jenkins-infra-bot

   on Nov 1, 2017

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: Jesse Glick
     Path:
      jep/200/README.adoc
     http://jenkins-ci.org/commit/jep/feb7c55886d3ccf494537e1f35780b4166e699e1
     Log:
       DRAFT: JEP-200: Switch Remoting/XStream blacklist to a whitelist (#23)
     
     
     	
     JENKINS-47736 Draft JEP.
     
     
     
     
     	
     Changes from proofreading.
     
     
     
     
     	
     Some notes on testing, as newly required in #24.
     
     
     
     
     	
     Noting RemoteClassLoader rule.
     
     
     
     
     	
     Formatting for links
     
     
     
     
     	
     Replace plus with backtick
     
     
     
     
     	
     Assign JEP Number: 200
     
     
     
     
     

   Code changed in jenkins
   User: Jesse Glick
   Path:
   jep/200/README.adoc
   http://jenkins-ci.org/commit/jep/feb7c55886d3ccf494537e1f35780b4166e699e1
   Log:
   DRAFT: JEP-200: Switch Remoting/XStream blacklist to a whitelist (#23)

   • JENKINS-47736 Draft JEP.

   • Changes from proofreading.

   • Some notes on testing, as newly required in Jenkins 8592 #24.

   • Noting RemoteClassLoader rule.

   • Formatting for links

   • Replace plus with backtick

   • Assign JEP Number: 200
6. jenkins-infra-bot commented on Nov 28, 2017

   

   jenkins-infra-bot

   on Nov 28, 2017

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: Jesse Glick
     Path:
      src/main/java/org/jvnet/hudson/test/MockQueueItemAuthenticator.java
     http://jenkins-ci.org/commit/jenkins-test-harness/3d9ebde50cf9dfcb297588f57d50905f8f94accc
     Log:
       JENKINS-47736 Do not even try to persist an Authentication.
     
     
     

   Code changed in jenkins
   User: Jesse Glick
   Path:
   src/main/java/org/jvnet/hudson/test/MockQueueItemAuthenticator.java
   http://jenkins-ci.org/commit/jenkins-test-harness/3d9ebde50cf9dfcb297588f57d50905f8f94accc
   Log:
   JENKINS-47736 Do not even try to persist an Authentication.
7. jenkins-infra-bot commented on Nov 28, 2017

   

   jenkins-infra-bot

   on Nov 28, 2017

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: Jesse Glick
     Path:
      src/main/java/org/jvnet/hudson/test/MockQueueItemAuthenticator.java
     http://jenkins-ci.org/commit/jenkins-test-harness/0639913590297601158e9aca395c3461005357df
     Log:
       Merge pull request #81 from jglick/whitelist-JENKINS-47736
     
     JENKINS-47736 Do not even try to persist an Authentication
     
     
     Compare: jenkinsci/jenkins-test-harness@52ef2fe...0639913
     
     

   Code changed in jenkins
   User: Jesse Glick
   Path:
   src/main/java/org/jvnet/hudson/test/MockQueueItemAuthenticator.java
   http://jenkins-ci.org/commit/jenkins-test-harness/0639913590297601158e9aca395c3461005357df
   Log:
   Merge pull request #81 from jglick/whitelist-JENKINS-47736

   JENKINS-47736 Do not even try to persist an Authentication

   Compare: jenkinsci/jenkins-test-harness@52ef2fe...0639913
8. jenkins-infra-bot commented on Dec 7, 2017

   

   jenkins-infra-bot

   on Dec 7, 2017

   Author

   More actions

   scm_issue_link:

   • Original comment link
   • Raw content of original comment:

     Code changed in jenkins
     User: Jesse Glick
     Path:
      src/test/java/hudson/plugins/copyartifact/CopyArtifactTest.java
     http://jenkins-ci.org/commit/copyartifact-plugin/e225ab7c034eb424a59372d55ac020aca8fe762f
     Log:
       Avoid a warning under JENKINS-47736.
     
     
     

   Code changed in jenkins
   User: Jesse Glick
   Path:
   src/test/java/hudson/plugins/copyartifact/CopyArtifactTest.java
   http://jenkins-ci.org/commit/copyartifact-plugin/e225ab7c034eb424a59372d55ac020aca8fe762f
   Log:
   Avoid a warning under JENKINS-47736.
9. jenkins-infra-bot commented on Jan 5, 2018

   

   jenkins-infra-bot

   on Jan 5, 2018

   Author

   More actions

   oleg_nenashev:

   • Original comment link
   • Raw content of original comment:

     I am going to convert it to EPIC so that we can track other action items separately
     

   I am going to convert it to EPIC so that we can track other action items separately
10. jenkins-infra-bot commented on Jan 5, 2018

    

    jenkins-infra-bot

    on Jan 5, 2018

    Author

    More actions

    scm_issue_link:

    • Original comment link
    • Raw content of original comment:

      Code changed in jenkins
      User: Oleg Nenashev
      Path:
       pom.xml
      http://jenkins-ci.org/commit/lib-jenkins-maven-embedder/fdf0ac0ce2fac2d706ddca98b06cd825cbdfe319
      Log:
        Merge pull request #15 from jglick/Jenkins-ClassFilter-Whitelisted
      
      JENKINS-47736 Jenkins-ClassFilter-Whitelisted
      
      
      

    Code changed in jenkins
    User: Oleg Nenashev
    Path:
    pom.xml
    http://jenkins-ci.org/commit/lib-jenkins-maven-embedder/fdf0ac0ce2fac2d706ddca98b06cd825cbdfe319
    Log:
    Merge pull request #15 from jglick/Jenkins-ClassFilter-Whitelisted

    JENKINS-47736 Jenkins-ClassFilter-Whitelisted
11. jenkins-infra-bot commented on Jan 9, 2018

    

    jenkins-infra-bot

    on Jan 9, 2018

    Author

    More actions

    scm_issue_link:

    • Original comment link
    • Raw content of original comment:

      Code changed in jenkins
      User: Jesse Glick
      Path:
       src/main/java/hudson/remoting/ClassFilter.java
       src/test/java/hudson/remoting/ClassFilterTest.java
      http://jenkins-ci.org/commit/remoting/1fda115f080dc3fc1063ca3496f49bb2853f380e
      Log:
        JENKINS-47736 Introduced ClassFilter.setDefault (#208)
      
      
      	
      JENKINS-47736 Introduced ClassFilter.setDefault.
      
      
      
      
      	
      Review comments from @oleg-nenashev.
      
      
      
      
      	
      JENKINS-47736 - Add some annotations, mostly to kick-off CI
      
      
      
      
      

    Code changed in jenkins
    User: Jesse Glick
    Path:
    src/main/java/hudson/remoting/ClassFilter.java
    src/test/java/hudson/remoting/ClassFilterTest.java
    http://jenkins-ci.org/commit/remoting/1fda115f080dc3fc1063ca3496f49bb2853f380e
    Log:
    JENKINS-47736 Introduced ClassFilter.setDefault (#208)

    • JENKINS-47736 Introduced ClassFilter.setDefault.

    • Review comments from @​oleg-nenashev.

    • JENKINS-47736 - Add some annotations, mostly to kick-off CI
12. jenkins-infra-bot commented on Jan 12, 2018

    

    jenkins-infra-bot

    on Jan 12, 2018

    Author

    More actions

    scm_issue_link:

    • Original comment link
    • Raw content of original comment:

      Code changed in jenkins
      User: Jesse Glick
      Path:
       core/src/main/java/hudson/util/XStream2.java
       core/src/main/java/jenkins/model/Jenkins.java
       core/src/main/java/jenkins/security/ClassFilterImpl.java
       core/src/main/java/jenkins/security/CustomClassFilter.java
       core/src/main/resources/jenkins/security/whitelisted-classes.txt
       pom.xml
       test/pom.xml
       test/src/test/groovy/hudson/cli/BuildCommandTest.groovy
       test/src/test/java/hudson/cli/BuildCommand2Test.java
       test/src/test/java/hudson/util/XStream2Security383Test.java
       test/src/test/java/jenkins/install/InstallUtilTest.java
       test/src/test/java/jenkins/install/SetupWizardTest.java
       test/src/test/java/jenkins/security/ClassFilterImplTest.java
       test/src/test/java/jenkins/security/CustomClassFilterTest.java
       test/src/test/java/jenkins/security/Security218CliTest.java
       test/src/test/java/jenkins/security/Security218Test.java
       test/src/test/resources/plugins/custom-class-filter.jpi
      http://jenkins-ci.org/commit/jenkins/903b4461d37170ccda49ce6637adf7cf4a261b93
      Log:
        JENKINS-47736 Switch Remoting/XStream blacklist to a whitelist.
      
      
      

    Code changed in jenkins
    User: Jesse Glick
    Path:
    core/src/main/java/hudson/util/XStream2.java
    core/src/main/java/jenkins/model/Jenkins.java
    core/src/main/java/jenkins/security/ClassFilterImpl.java
    core/src/main/java/jenkins/security/CustomClassFilter.java
    core/src/main/resources/jenkins/security/whitelisted-classes.txt
    pom.xml
    test/pom.xml
    test/src/test/groovy/hudson/cli/BuildCommandTest.groovy
    test/src/test/java/hudson/cli/BuildCommand2Test.java
    test/src/test/java/hudson/util/XStream2Security383Test.java
    test/src/test/java/jenkins/install/InstallUtilTest.java
    test/src/test/java/jenkins/install/SetupWizardTest.java
    test/src/test/java/jenkins/security/ClassFilterImplTest.java
    test/src/test/java/jenkins/security/CustomClassFilterTest.java
    test/src/test/java/jenkins/security/Security218CliTest.java
    test/src/test/java/jenkins/security/Security218Test.java
    test/src/test/resources/plugins/custom-class-filter.jpi
    http://jenkins-ci.org/commit/jenkins/903b4461d37170ccda49ce6637adf7cf4a261b93
    Log:
    JENKINS-47736 Switch Remoting/XStream blacklist to a whitelist.
13. jenkins-infra-bot commented on Jan 12, 2018

    

    jenkins-infra-bot

    on Jan 12, 2018

    Author

    More actions

    scm_issue_link:

    • Original comment link
    • Raw content of original comment:

      Code changed in jenkins
      User: Oleg Nenashev
      Path:
       pom.xml
      http://jenkins-ci.org/commit/jenkins/29362a5b7b94ddfe0ead38c423c54c81bfced53d
      Log:
        JENKINS-47736 - Use the new snapshot: remoting-3.16-20171228.162243-1
      
      
      

    Code changed in jenkins
    User: Oleg Nenashev
    Path:
    pom.xml
    http://jenkins-ci.org/commit/jenkins/29362a5b7b94ddfe0ead38c423c54c81bfced53d
    Log:
    JENKINS-47736 - Use the new snapshot: remoting-3.16-20171228.162243-1
14. jenkins-infra-bot commented on Jan 12, 2018

    

    jenkins-infra-bot

    on Jan 12, 2018

    Author

    More actions

    scm_issue_link:

    • Original comment link
    • Raw content of original comment:

      Code changed in jenkins
      User: Oleg Nenashev
      Path:
       pom.xml
      http://jenkins-ci.org/commit/jenkins/88e756de6fe6c3333658e6d4be6aad2323a63e09
      Log:
        JENKINS-47736 - Use the released version of Remoting 3.16
      
      
      

    Code changed in jenkins
    User: Oleg Nenashev
    Path:
    pom.xml
    http://jenkins-ci.org/commit/jenkins/88e756de6fe6c3333658e6d4be6aad2323a63e09
    Log:
    JENKINS-47736 - Use the released version of Remoting 3.16
15. jenkins-infra-bot commented on Jan 12, 2018

    

    jenkins-infra-bot

    on Jan 12, 2018

    Author

    More actions

    scm_issue_link:

    • Original comment link
    • Raw content of original comment:

      Code changed in jenkins
      User: Jesse Glick
      Path:
       core/src/main/java/hudson/PluginManager.java
       core/src/main/java/hudson/util/XStream2.java
       core/src/main/java/jenkins/MasterToSlaveFileCallable.java
       core/src/main/java/jenkins/SlaveToMasterFileCallable.java
       core/src/main/java/jenkins/model/Jenkins.java
       core/src/main/java/jenkins/security/ClassFilterImpl.java
       core/src/main/java/jenkins/security/CustomClassFilter.java
       core/src/main/java/jenkins/security/MasterToSlaveCallable.java
       core/src/main/java/jenkins/security/SlaveToMasterCallable.java
       core/src/main/resources/jenkins/security/whitelisted-classes.txt
       pom.xml
       test/src/test/java/hudson/util/XStream2Security383Test.java
       test/src/test/java/jenkins/install/InstallUtilTest.java
       test/src/test/java/jenkins/install/SetupWizardTest.java
       test/src/test/java/jenkins/security/ClassFilterImplTest.java
       test/src/test/java/jenkins/security/CustomClassFilterTest.java
       test/src/test/java/jenkins/security/Security218CliTest.java
       test/src/test/java/jenkins/security/Security218Test.java
       test/src/test/resources/plugins/custom-class-filter.jpi
      http://jenkins-ci.org/commit/jenkins/cb4903c20e788f015f6210a965a2759009ff24f2
      Log:
        [JEP-200] JENKINS-47736 Merged #3120: ClassFilterImpl
      
      
      

    Code changed in jenkins
    User: Jesse Glick
    Path:
    core/src/main/java/hudson/PluginManager.java
    core/src/main/java/hudson/util/XStream2.java
    core/src/main/java/jenkins/MasterToSlaveFileCallable.java
    core/src/main/java/jenkins/SlaveToMasterFileCallable.java
    core/src/main/java/jenkins/model/Jenkins.java
    core/src/main/java/jenkins/security/ClassFilterImpl.java
    core/src/main/java/jenkins/security/CustomClassFilter.java
    core/src/main/java/jenkins/security/MasterToSlaveCallable.java
    core/src/main/java/jenkins/security/SlaveToMasterCallable.java
    core/src/main/resources/jenkins/security/whitelisted-classes.txt
    pom.xml
    test/src/test/java/hudson/util/XStream2Security383Test.java
    test/src/test/java/jenkins/install/InstallUtilTest.java
    test/src/test/java/jenkins/install/SetupWizardTest.java
    test/src/test/java/jenkins/security/ClassFilterImplTest.java
    test/src/test/java/jenkins/security/CustomClassFilterTest.java
    test/src/test/java/jenkins/security/Security218CliTest.java
    test/src/test/java/jenkins/security/Security218Test.java
    test/src/test/resources/plugins/custom-class-filter.jpi
    http://jenkins-ci.org/commit/jenkins/cb4903c20e788f015f6210a965a2759009ff24f2
    Log:
    [JEP-200] JENKINS-47736 Merged #3120: ClassFilterImpl
16. 4 remaining items

    Load more
17. jenkins-infra-bot

    added

    security

    imported-jira-issue

    component:core

    resolution:fixed

    priority:critical

    jira-type:epic

    component:jenkins-test-harness

    on Nov 24, 2025
18. jenkins-infra-bot

    added a sub-issue on Nov 24, 2025

    • [JENKINS-48814] JEP-200 Testing (PCT/ATH/etc.) #22496
19. jenkins-infra-bot

    added the

    Epic

    issue type on Nov 24, 2025
20. jenkins-infra-bot

    removed

    jira-type:epic

    on Nov 24, 2025
21. jenkins-infra-bot

    added sub-issues on Nov 24, 2025

    • [JENKINS-48932] Build-failure-analyzer afected by JEP-200 in Jenkins 2.102 #22507
    • [JENKINS-49016] Android-lint plugin affected by JEP in 2.102 #22519
    • [JENKINS-49070] java.math.BigDecimal in JRE might be dangerous (JEP in 2.103) #22525
22. jenkins-infra-bot

    added sub-issues on Dec 12, 2025

    • [JENKINS-50781] Shiro Plugin - Refusing to marshal org.apache.shiro.authc.credential.AllowAllCredentialsMatcher for security reasons #25198
    • [JENKINS-72719] Svn-Kit 1.10.10 might be dangerous subversion-plugin#1565