[JIRA] (JENKINS-57171) Permissive script security plugin is broken after updating to script security 1.58

[gabloe@microsoft.com (JIRA)]

Gabriel Loewen updated an issue

Jenkins / JENKINS-57171 Permissive script security plugin is broken after updating to script security 1.58 Change By: Gabriel Loewen After updating to Script Security 1.58 permissive script security no longer permits unsafe method calls.  I have *-Dpermissive-script-security.enabled=no_security* set up in the java args, and before upgrading to 1.58 I was receiving no warnings/errors when calling unsafe methods as expected .   After upgrading I see many warnings in my pipeline log, such as: Scripts not permitted to use staticMethod org.jenkinsci.plugins.workflow.cps.Safepoint safepoint. Administrators can decide whether to approve or reject this signature.   Add Comment

This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

[gabloe@microsoft.com (JIRA)]

Gabriel Loewen created an issue

Jenkins / JENKINS-57171 Permissive script security plugin is broken after updating to script security 1.58

Issue Type: Bug Assignee: Oliver Gondža Components: permissive-script-security-plugin, script-security-plugin Created: 2019-04-24 17:05 Environment: Jenkins 2.164.2 Script Security 1.58 Permissive Script Security 0.3 Labels: jenkins security script-security Priority: Major Reporter: Gabriel Loewen After updating to Script Security 1.58 permissive script security no longer permits unsafe method calls.  I have -Dpermissive-script-security.enabled=no_security set up in the java args, and before upgrading to 1.58 I was receiving no warnings/errors when calling unsafe methods.  After upgrading I see many warnings in my pipeline log, such as:

Scripts not permitted to use staticMethod org.jenkinsci.plugins.workflow.cps.Safepoint safepoint. Administrators can decide whether to approve or reject this signature.

Add Comment

[be_ray@sbcglobal.net (JIRA)]

Brian Ray commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58 I think the actual incompatibility is with workflow-cps-2.67, specifically #280 (JENKINS-34973). As noted at the top of the PR thread it is complementary to script-security-plugin/#243. After running into the current issue with permissive-script-security-0.3, script-security-1.58, workflow-cps-2.67 I downgraded the latter plugin back to 2.66 and the issue disappeared. There are two other interesting aspects in my troubleshooting attempts: It does not seem possible to effectively whitelist the method, at least in the UI. I can whitelist it but on the next run the script security warning is logged again. Reproduction is possible via a completely empty pipeline script.

Add Comment

[be_ray@sbcglobal.net (JIRA)]

Brian Ray updated an issue

Jenkins / JENKINS-57171

Permissive script security plugin is broken after updating to script security 1.58

Change By: Brian Ray Component/s: workflow-cps-plugin

Add Comment

[be_ray@sbcglobal.net (JIRA)]

Brian Ray updated an issue

Jenkins / JENKINS-57171 Permissive script security plugin is broken after updating to script security 1.58

Change By: Brian Ray Environment:

Jenkins 2.164.2 Script Security 1.58 Permissive Script Security 0.3

Pipeline: Groovy 2.67

Add Comment

[julienduchesne@live.com (JIRA)]

Julien Duchesne commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58 I can confirm what Brian says. Also, trying to approve the rejected methods froze our Jenkins instance (Actually, two of us made the same mistake on different instances).

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

Thanks, I managed to reproduce the problem introduced between script-security-1.57 and script-security-1.58. Let me see what we can do.

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža started work on JENKINS-57171

Change By: Oliver Gondža Status: Open In Progress

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

It is 4c12f752e15bdf1d879019e8157954688b35b104 in script-security that has caused this to break. On first glance, the problem appears fixable.

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

Fix proposed: https://github.com/jenkinsci/permissive-script-security-plugin/pull/2

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža updated JENKINS-57171

Jenkins / JENKINS-57171

Permissive script security plugin is broken after updating to script security 1.58

Change By: Oliver Gondža Status: In Progress Review

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža updated JENKINS-57171

Fixed in 0.4 released just now.

Jenkins / JENKINS-57171 Permissive script security plugin is broken after updating to script security 1.58

Change By: Oliver Gondža Status: In Review Resolved Resolution: Fixed Released As: 0.4

Add Comment

[careje@gmail.com (JIRA)]

Jeff Care commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58 We are still seeing

Scripts not permitted to use staticMethod org.jenkinsci.plugins.workflow.cps.Safepoint safepoint.

even after applying 0.4

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

Jeff Care, be more specific. The problem this issue addresses is that even when the signature is explicitly whitelisted, it is still reported/blocked (depending on your config). Is that signature whitelisted on your instance? How is the plugin configured?

Add Comment

[careje@gmail.com (JIRA)]

Jeff Care commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

Yes, whitelisted and still getting that message.

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

Jeff Care, strange, can you provide as with a minimal reproducer of what you are observing?

Add Comment

[lai.andrea75@gmail.com (JIRA)]

Andrea Lai commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

I am still seen the issue as well. Step:   1. Create Pipeline job: "pipeline {agent { label 'master'} stages {stage('Clear working directory') {steps {ansiColor('xterm') {deleteDir()} }}}}"   2. Run the job above and it passes with lots of "Scripts not permitted to use new ..."   3. Go to Script Approval page and approve everything.   4. The Approval page does not have any pending approvals.   5 .Run the Pipeline job again   6. Job above passes with lots of "Scripts not permitted to use new ..." again   7. Go to Script Approval page and all the pending approvals are back even if they are already listed in the "Signatures already approved:" section.

Add Comment

[lai.andrea75@gmail.com (JIRA)]

Andrea Lai updated an issue

Jenkins / JENKINS-57171

Permissive script security plugin is broken after updating to script security 1.58

Change By: Andrea Lai Attachment: example.JPG

Add Comment

[lai.andrea75@gmail.com (JIRA)]

Andrea Lai commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58 I am attaching a screenshot showing the Approval page asking to approve items already in the "Signatures already approved"

Add Comment

[lai.andrea75@gmail.com (JIRA)]

Andrea Lai edited a comment on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

I am attaching a screenshot showing the Approval page asking to approve items already in the "Signatures already approved" !example.JPG |width=667,height=407 !

Add Comment

[lai.andrea75@gmail.com (JIRA)]

Andrea Lai updated an issue

Jenkins / JENKINS-57171

Permissive script security plugin is broken after updating to script security 1.58

Change By: Andrea Lai Attachment: scriptApproval.xml

Add Comment

[lai.andrea75@gmail.com (JIRA)]

Andrea Lai commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58 Please find attached a copy of scscriptApproval.xmlriptApproval.xml

Add Comment

[lai.andrea75@gmail.com (JIRA)]

Andrea Lai reopened an issue

I am re-opening as 2 people reported the change did not address the issue for some use cases.

Jenkins / JENKINS-57171

Permissive script security plugin is broken after updating to script security 1.58

Change By: Andrea Lai Resolution: Fixed Status: Resolved Reopened

Add Comment

[michellepogado@gmail.com (JIRA)]

Michelle Pogado commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58 Also experiencing the same problem with the following version: Jenkins 2.168

Script Security 1.58  Permissive Script Security 0.3

Pipeline: Groovy 2.68

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

I managed to reproduce the issue using both declarative and scriptable pipeline, when the plugin in enabled state. The build is permitted to invoke the signatures and they are logged in Jenkins log. The execution suggests several internal signatures for approval, even though they ware approved before.

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

Alright, it turned out the changes in 1.58 uncovered a conceptual problem in the plugin. I have just release 0.5 with the new unsafe signature reworked. https://github.com/jenkinsci/permissive-script-security-plugin/commit/7458ae4d1363a95d78fb8212460b4056f4b205ee

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža updated JENKINS-57171

Jenkins / JENKINS-57171

Permissive script security plugin is broken after updating to script security 1.58

Change By: Oliver Gondža Status: Reopened Fixed but Unreleased Resolution: Fixed Released As: 0. 4 5

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža edited a comment on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

Alright, it turned out the changes in 1.58 uncovered a conceptual problem in the plugin. I have just release 0.5 with the new unsafe signature detection reworked. https://github.com/jenkinsci/permissive-script-security-plugin/commit/7458ae4d1363a95d78fb8212460b4056f4b205ee

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža updated JENKINS-57171

Jenkins / JENKINS-57171

Permissive script security plugin is broken after updating to script security 1.58

Change By: Oliver Gondža Status: Fixed but Unreleased Resolved

Add Comment

[be_ray@sbcglobal.net (JIRA)]

Brian Ray commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58 0.5 seems to clear up the issue in my local test Jenkins now with permissive-script-security.enabled=true. We'll try 0.5 in production soon. Thank you Oliver Gondža.

Add Comment

[xouthier@yahoo.fr (JIRA)]

X O commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

Hi, yes 0.5 fixes this issue but it generates another one: instead seeing the Pipeline script from SCM (SCM/Git) for the pipeline definition in the configure page according to what is written the config.xml of a pipeline job, we see pipeline script with an empty script. It's impossible to view it in the GUI. Interestingly, the correct configuration is used. Reverting to 0.3 fix this behavior but of course lead to the current issue. BTW, the current issue seems only cosmetic, isn't it? There is no real need for an admin to enable the use of the "unsecured" methods. At least my pipelines do what they are suppose to do?! We have a lot of plugins but here are some details of what is used: Jenkins: 2.179 Script Security 1.60 Permissive Script Security 0.3 or 0.5 Pipeline Groovy 2.70 Git 3.10.0 Thanks

Add Comment

[shen3lu4@gmail.com (JIRA)]

Lu Shen commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

We recently did an upgrade on Jenkins and plugins. The "permissive-script-security.enabled=true" setting used to allow scripts to be run in the pipeline but not any more after the upgrade. Jenkins log file would log issues like: org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use staticMethod java.security.MessageDigest getInstance java.lang.String and the scripts comes into "In-process script approval". Version info: Jenkins: 2.164.3 Script Security 1.62 Permissive Script Security 0.5 Pipeline Groovy 2.73

Add Comment

This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)

[ogondza@gmail.com (JIRA)]

Oliver Gondža commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58

Lu Shen, you are commenting on a once resolved issue. File a new one instead.

Add Comment

[ogondza@gmail.com (JIRA)]

Oliver Gondža closed an issue as Fixed

Jenkins / JENKINS-57171

Permissive script security plugin is broken after updating to script security 1.58

Change By: Oliver Gondža Status: Resolved Closed

Add Comment

[peter.wiseman@gmail.com (JIRA)]

Peter Wiseman commented on JENKINS-57171

Re: Permissive script security plugin is broken after updating to script security 1.58 Oliver Gondža do you have a reference for a new issue that you're working on?  Maybe JENKINS-59145 (Pipeline script UI) or JENKINS-59227 (Global Pipeline Libraries configuraton)? With Permissive Script Security at 0.5, the Global Pipeline Library SCM configuration information is no longer visible.  If that were all it might be ok, but upon saving, the configuration, is removed.

Add Comment