[JENKINS-49994] Report uses of anonymous classes in outgoing Remoting packets

~~JENKINS-49795~~ issues warnings about both reads and writes of anonymous (and similar) classes for XStream, because XStream2.BlacklistedTypesConverter calls ClassFilter.DEFAULT in both directions. But currently these warnings are issued only for incoming Remoting packets—either slave → master callables, or return types of master → slave callables. The much more common case of anonymous (etc.) classes being used for master → slave callables is not detected.

Originally reported by jglick, imported from: Report uses of anonymous classes in outgoing Remoting packets

assignee: jglick
status: Resolved
priority: Major
component(s): remoting
label(s): diagnostics, robustness
resolution: Fixed
resolved: 2018-03-13T21:47:43+00:00
votes: 0
watchers: 2
imported: 2025-11-25

Raw content of original issue

JENKINS-49795 issues warnings about both reads and writes of anonymous (and similar) classes for XStream, because XStream2.BlacklistedTypesConverter calls ClassFilter.DEFAULT in both directions. But currently these warnings are issued only for incoming Remoting packets—either slave → master callables, or return types of master → slave callables. The much more common case of anonymous (etc.) classes being used for master → slave callables is not detected.

Remote links associated with this issue:

scm_issue_link:

Original comment link

Raw content of original comment:

Code changed in jenkins User: Jesse Glick Path: content/redirect/serialization-of-anonymous-classes.adoc http://jenkins-ci.org/commit/jenkins.io/11e02be65d669320d023a97bbefd3eb7f3ecbef9 Log: ~~JENKINS-49994~~ Getting a redirect in place.

Code changed in jenkins
User: Jesse Glick
Path:
content/redirect/serialization-of-anonymous-classes.adoc
http://jenkins-ci.org/commit/jenkins.io/11e02be65d669320d023a97bbefd3eb7f3ecbef9
Log:
~~JENKINS-49994~~ Getting a redirect in place.

scm_issue_link:

Original comment link

Raw content of original comment:

Code changed in jenkins User: R. Tyler Croy Path: content/redirect/serialization-of-anonymous-classes.adoc http://jenkins-ci.org/commit/jenkins.io/30592f98d9aa1a982f39220013e60286e6f7c1b5 Log: Merge pull request #1439 from jglick/anonymous-warning-~~JENKINS-49994~~

~~JENKINS-49994~~ Set up a redirect for messages about serialization of anonymous classes

Compare: jenkins-infra/jenkins.io@a178b2b...30592f9

Code changed in jenkins
User: R. Tyler Croy
Path:
content/redirect/serialization-of-anonymous-classes.adoc
http://jenkins-ci.org/commit/jenkins.io/30592f98d9aa1a982f39220013e60286e6f7c1b5
Log:
Merge pull request #1439 from jglick/anonymous-warning-~~JENKINS-49994~~

~~JENKINS-49994~~ Set up a redirect for messages about serialization of anonymous classes

Compare: jenkins-infra/jenkins.io@a178b2b...30592f9

danielbeck:

Original comment link

Raw content of original comment:

Motivation explained in [JENKINS-49795] Fix bad serialization of ParametersAction.parameterDefinitionNames and make sure this kind of mistake produces a warning in the future jenkins#3312 (comment)

Note that this will issue warnings when encountering anonymous (etc.) classes either in Remoting or XStream. For XStream cases, these are always plainly bugs. For Remoting, it is not necessarily a problem—RemoteClassLoader ensures that the same bytecode version is used on either side—but there are still reasons to really prefer named classes:

After jenkinsci/remoting#204, you will get more meaningful logging. See an example in #3071.

It is all too easy to accidentally pull in crazy stuff via Callable this$0 (jenkinsci/packer-plugin#22 for just the most recent example). If you are lucky, all that implicit data will be small and (safely) Serializable.

Motivation explained in jenkinsci/jenkins#3312 (comment)

Note that this will issue warnings when encountering anonymous (etc.) classes either in Remoting or XStream. For XStream cases, these are always plainly bugs. For Remoting, it is not necessarily a problem—RemoteClassLoader ensures that the same bytecode version is used on either side—but there are still reasons to really prefer named classes:

After jenkinsci/remoting#204, you will get more meaningful logging. See an example in #3071.

It is all too easy to accidentally pull in crazy stuff via Callable this$0 (jenkinsci/packer-plugin#22 for just the most recent example). If you are lucky, all that implicit data will be small and (safely) Serializable.

danielbeck:

Original comment link
Raw content of original comment:
```
Merged into core towards 2.112.
```

Merged into core towards 2.112.

[Original relates_to from Jira: JENKINS-53619]

Navigation Menu

Repository navigation

[JENKINS-49994] Report uses of anonymous classes in outgoing Remoting packets #1313

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[JENKINS-49994] Report uses of anonymous classes in outgoing Remoting packets #1313

Description

Activity

jenkins-infra-bot commented on Mar 7, 2018

jenkins-infra-bot commented on Mar 7, 2018

jenkins-infra-bot commented on Mar 7, 2018

jenkins-infra-bot commented on Mar 18, 2018

jenkins-infra-bot commented on Mar 19, 2018

jenkins-infra-bot commented on Nov 25, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions