In trying to make a temporary stopgap for JIRA-26100 <https://issues.jenkins-ci.org/browse/JENKINS-26100>, I came up with this toy code that runs fine in the (unsandboxed, natch) Script Console:
import org.tmatesoft.svn.core.internal.io.dav.DAVRepositoryFactory import org.tmatesoft.svn.core.SVNURL DAVRepositoryFactory.setup() url = SVNURL.parseURIEncoded( 'https://foosvnserver/svn/awesome_proj/trunk' ) //FIXME: can't get this past script-security even when whitelisted per the // stack trace, // // staticMethod org.tmatesoft.svn.core.internal.io.dav.DAVRepositoryFactory create org.tmatesoft.svn.core.SVNURL repo = DAVRepositoryFactory.create(url) repo.properties println "Latest rev for trunk Java: $repo.latestRevision" In trying it as a sandboxed, non-multibranch Pipeline script I had to whitelist the SVNKit static methods. The first two that popped up went fine, the approval effectively whitelisted them: staticMethod org.tmatesoft.svn.core.SVNURL parseURIEncoded java.lang.String staticMethod org.tmatesoft.svn.core.internal.io.dav.DAVRepositoryFactory setup But the last one is apparently intractible. I had to manually add this one to scriptApproval.xml because the scriptApproval page wouldn't display it for approval. staticMethod org.tmatesoft.svn.core.internal.io.dav.DAVRepositoryFactory create org.tmatesoft.svn.core.SVNURL Even after bouncing the master the sandboxed script still throws the following stack trace. It feels like I'm missing something elementary. Any ideas on why that method is not effectively being whitelisted? (Note: the stack trace references line 12 of the script but I chopped some comment lines from the above script excerpt. It is flagging the *DAVRepositoryFactory.create(url*) call. org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: unclassified staticMethod org.tmatesoft.svn.core.internal.io.dav. DAVRepositoryFactory create org.tmatesoft.svn.core.SVNURL at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy. SandboxInterceptor.onStaticCall(SandboxInterceptor.java:138) at org.kohsuke.groovy.sandbox.impl.Checker$2.call(Checker.java:180) at org.kohsuke.groovy.sandbox.impl.Checker.checkedStaticCall(Checker. java:177) at org.kohsuke.groovy.sandbox.impl.Checker.checkedCall(Checker.java:91) at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.methodCall( SandboxInvoker.java:16) at WorkflowScript.run(WorkflowScript:12) at ___cps.transform___(Native Method) at com.cloudbees.groovy.cps.impl.ContinuationGroup.methodCall( ContinuationGroup.java:48) at com.cloudbees.groovy.cps.impl.FunctionCallBlock$ContinuationImpl. dispatchOrArg(FunctionCallBlock.java:109) at com.cloudbees.groovy.cps.impl.FunctionCallBlock$ContinuationImpl. fixArg(FunctionCallBlock.java:82) at sun.reflect.GeneratedMethodAccessor342.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke( DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at com.cloudbees.groovy.cps.impl.ContinuationPtr$ContinuationImpl. receive(ContinuationPtr.java:72) at com.cloudbees.groovy.cps.impl.PropertyishBlock$ContinuationImpl.get( PropertyishBlock.java:76) at com.cloudbees.groovy.cps.LValueBlock$GetAdapter.receive(LValueBlock. java:30) at com.cloudbees.groovy.cps.impl.PropertyishBlock$ContinuationImpl. fixName(PropertyishBlock.java:66) at sun.reflect.GeneratedMethodAccessor344.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke( DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at com.cloudbees.groovy.cps.impl.ContinuationPtr$ContinuationImpl. receive(ContinuationPtr.java:72) at com.cloudbees.groovy.cps.impl.ConstantBlock.eval(ConstantBlock.java: 21) at com.cloudbees.groovy.cps.Next.step(Next.java:58) at com.cloudbees.groovy.cps.Continuable.run0(Continuable.java:154) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.access$001( SandboxContinuable.java:18) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable$1.call( SandboxContinuable.java:33) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable$1.call( SandboxContinuable.java:30) at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox. runInSandbox(GroovySandbox.java:108) at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.run0( SandboxContinuable.java:30) at org.jenkinsci.plugins.workflow.cps.CpsThread.runNextChunk(CpsThread. java:163) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.run(CpsThreadGroup. java:324) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.access$100( CpsThreadGroup.java:78) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call( CpsThreadGroup.java:236) at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call( CpsThreadGroup.java:224) at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$2.call( CpsVmExecutorService.java:63) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at hudson.remoting.SingleLaneExecutorService$1.run( SingleLaneExecutorService.java:112) at jenkins.util.ContextResettingExecutorService$1.run( ContextResettingExecutorService.java:28) at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java: 511) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor. java:1142) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor .java:617) at java.lang.Thread.run(Thread.java:745) Finished: FAILURE -- You received this message because you are subscribed to the Google Groups "Jenkins Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-users+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/bb5e9d68-19a0-43a6-9f20-e665ecb8946f%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
