[JENKINS-44942] - FilePath.list() & .listDirectories() null safety

[jglick]

Description

No known NPE resulting from this, but better to be on the safe side.

https://issues.jenkins-ci.org/browse/JENKINS-44942

Changelog entries

Proposed changelog entries:

• JENKINS-44942 - Prevent possible NullPointerException resulting when listing remote directories using the FilePath#list() and FilePath#ListDirectories() API.

Desired reviewers

@reviewbybees

[ghost]

This pull request originates from a CloudBees employee. At CloudBees, we require that all pull requests be reviewed by other CloudBees employees before we seek to have the change accepted. If you want to learn more about our process please see this explanation.

[oleg-nenashev]

It would be also great to catch the SecurityException from ListFiles() then. Similarly to jenkinsci/periodicbackup-plugin@466393e

🐝 anyway though it is not full fix

[jglick]

It would be also great to catch the SecurityException from ListFiles() then

Does not make sense to me. There should not be a SecurityManager set on the Jenkins master or agents, or if there is, it must not deny file reads.

[oleg-nenashev]

There should not be a SecurityManager set on the Jenkins master or agents....

Not documented anywhere. I also do not see a reason for such no-go answer. Security managers are being widely used on security-paranoid enterprise instances.

, or if there is, it must not deny file reads.

Likely yes. The problem is what's going to happen if it does, we may get into undefined behavior due to the runtime exceptions (hanging agents, file leaks, etc.). But I'd guess FilePath is not the first thing to worry about if we are really aware about SecurityException handling in Jenkins.

Anyway, I have approved the PR

[jglick]

Security managers are being widely used on security-paranoid enterprise instances.

Huh?? You would to patch Jenkins sources to install a security manager. And you will very likely break all kinds of things in the process. Jenkins is designed to assume it has full control over the JVM.

[jglick]

@reviewbybees done

[oleg-nenashev]

Created issue placeholder just in case we decide to backport it: https://issues.jenkins-ci.org/browse/JENKINS-44942