[JIRA] (JENKINS-53800) Whitelisting misc. methods

[haridara@gmail.com (JIRA)]

Hari Dara created an issue

Jenkins / JENKINS-53800 Whitelisting misc. methods Issue Type: Improvement Assignee: Hari Dara Components: script-security-plugin Created: 2018-09-26 17:02 Environment: Jenkins 2.89.3  Pipeline Groovy 2.53  Script Security Plugin 1.44 Priority: Major Reporter: Hari Dara The following operations are currently not whitelisted but they should be safe: isinstance check java.lang.Throwable.getCause() java.util.Arrays.asList() java.util.regex.MatchResult.group(String) List - List Add Comment

This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

[haridara@gmail.com (JIRA)]

Hari Dara commented on JENKINS-53800

Re: Whitelisting misc. methods Sent PR: https://github.com/jenkinsci/script-security-plugin/pull/226

Add Comment

[haridara@gmail.com (JIRA)]

Hari Dara commented on JENKINS-53800

Re: Whitelisting misc. methods This was addressed in this PR: https://github.com/jenkinsci/script-security-plugin/pull/226

Add Comment

[haridara@gmail.com (JIRA)]

Hari Dara commented on JENKINS-53800

Re: Whitelisting misc. methods Devin Nusbaum: Could you update the status for this one too?

Add Comment

[dnusbaum@cloudbees.com (JIRA)]

Devin Nusbaum resolved as Fixed

Hari Dara Updated. Are you sure you don't have access to modify the ticket yourself when logged in? I don't think there is anything special about my account, you just need to be logged in, then click "Workflow", then "Resolved".

Jenkins / JENKINS-53800 Whitelisting misc. methods

Change By: Devin Nusbaum Status: Open Resolved Resolution: Fixed Released As: script-security 1.47

Add Comment

[haridara@gmail.com (JIRA)]

Hari Dara commented on JENKINS-53800

Re: Whitelisting misc. methods I guess I just couldn't figure out how to do it, thanks for pointing it out. However, how would I know what to enter for "Released As"?

Add Comment

[dnusbaum@cloudbees.com (JIRA)]

Devin Nusbaum commented on JENKINS-53800

Re: Whitelisting misc. methods Yeah, in that case you'd have to go through the changelog on the wiki and figure out what version it was released in. Normally the person who released the plugin should update the ticket, probably someone just forgot for your two tickets. It helps if in GitHub you make the PR title start with "[JENKINS-XXXXX]" and add a "See JENKINS-XXXXX" link to the PR description, but in this case you already did that, so nothing wrong on your side.

Add Comment