Support Java 25

[MarkEWaite]

Support Java 25

Don't add String.getChars(int, int, char[], int) or AbstractStringBuilder.getChars(int, int, char[], int) to the generic whitelist when running on Java 25 because those methods are now inherited from CharSequence.getChars(int, int, char[]. int)

Java 25 adds a new method CharSequence.getChars(int, int, char[], int) that is then used in the String class and the AbstractStringBuilder class.

Java 25 CharSequence javadoc:

• https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/lang/CharSequence.html

Java 21 CharSequence javadoc:

• https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/lang/CharSequence.html

Switches to only test Java 25 and Java 21 because we've found no issues that were specific to the Java 17 compiler.

Testing done

• Confirmed that test fails on Java 25 without this change
• Confirmed that tests pass on Java 25 with this change
• Confirmed that tests pass on Java 21 with this change
• Confirmed that tests pass on Java 17 with this change

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

[MarkEWaite]

I would appreciate a review from either @jglick or @dwnusbaum since they are most familiar with this code.

[dwnusbaum]

@MarkEWaite unless this case is unique, normally when adapting to these kinds of changes we just add the new signatures to generic-whitelist, and then adjust StaticWhitelistTest to ignore the signatures which are only available in some Java versions. Compare with #394 and #453.

[MarkEWaite]

add the new signatures to generic-whitelist

Thanks! I've done that in 2408872 . Much appreciated!

[dwnusbaum]

Looks like StaticWhitelistTest.KNOWN_GOOD_SIGNATURES will need to be updated to ignore the old signature that no longer exists in Java 25+:

java.lang.AssertionError: method java.lang.AbstractStringBuilder getChars int int char[] int does not exist (or is an override)
	at org.junit.Assert.fail(Assert.java:89)
	at org.junit.Assert.assertTrue(Assert.java:42)
	at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelistTest.sanity(StaticWhitelistTest.java:106)
	at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.GenericWhitelistTest.sanity(GenericWhitelistTest.java:39)
	at java.base/java.lang.reflect.Method.invoke(Method.java:565)

[MarkEWaite]

I'm disappearing for two weeks, so won't be able to make the necessary final change before I leave. Others are welcome to make the change or it can wait until I return.

[dwnusbaum]

Tests should be fixed by e23e24f, or at least I checked that GenericWhitelistTest passes against java 21 and 25 with that commit.