Suspect that it is possible to 'break' Jenkins with illegal XPath expressions

[Pasi]

Yesterday I did a lot of XPath (illegal / malformed) queries against
Jenkins and now jenkins.log is filled with
'java.lang.reflect.InvocationTargetException' and 'Untrapped Error in
Servlet' information.

I didn't notice this until the afternoon as the Jenkins dashboard
slowed down to a crawl, and log started showing lots of
'java.lang.OutOfMemoryError: Java heap space' errors. First I thought
that the issue was with Slave Squatter plugin as this also showed up
in the logs, but now I'm starting to think I got the Jenkins close to
a crash state with these XPath queries. Do you guys think this is
possible?

Here's one snippet of the log (this part is the one where I thought
the culprit was Slave Squatter plugin, but maybe it isn't):

[webapp 2011/05/12 09:48:34] - Error while serving http://jenkins:8080/queue/api/xml
java.lang.reflect.InvocationTargetException
at sun.reflect.GeneratedMethodAccessor720.invoke(Unknown Source)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:
43)
at java.lang.reflect.Method.invoke(Method.java:616)
at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:
282)
at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:149)
at
org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:
88)
at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:103)
at
org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:
53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:561)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:646)
at org.kohsuke.stapler.MetaClass$4.doDispatch(MetaClass.java:195)
at
org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:
53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:561)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:646)
at org.kohsuke.stapler.MetaClass$4.doDispatch(MetaClass.java:195)
at
org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:
53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:561)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:646)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:477)
at org.kohsuke.stapler.Stapler.service(Stapler.java:159)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:45)
at winstone.ServletConfiguration.execute(ServletConfiguration.java:
249)
at winstone.RequestDispatcher.forward(RequestDispatcher.java:335)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:378)
at hudson.util.PluginServletFilter
$1.doFilter(PluginServletFilter.java:94)
at
hudson.plugins.greenballs.GreenBallFilter.doFilter(GreenBallFilter.java:
52)
at hudson.util.PluginServletFilter
$1.doFilter(PluginServletFilter.java:97)
at
net.bull.javamelody.MonitoringFilter.doFilter(MonitoringFilter.java:
157)
at
net.bull.javamelody.MonitoringFilter.doFilter(MonitoringFilter.java:
131)
at
net.bull.javamelody.PluginMonitoringFilter.doFilter(PluginMonitoringFilter.java:
82)
at
org.jvnet.hudson.plugins.monitoring.HudsonMonitoringFilter.doFilter(HudsonMonitoringFilter.java:
84)
at hudson.util.PluginServletFilter
$1.doFilter(PluginServletFilter.java:97)
at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:
86)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:195)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:368)
at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:47)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:195)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:368)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:84)
at
hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:
51)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:
166)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:
125)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:
135)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:
271)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:
173)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:
249)
at
hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:
66)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:
76)
at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:195)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:368)
at
hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:
81)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:195)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:368)
at winstone.RequestDispatcher.forward(RequestDispatcher.java:333)
at
winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:
244)
at winstone.RequestHandlerThread.run(RequestHandlerThread.java:150)
at java.lang.Thread.run(Thread.java:636)
Caused by: org.kohsuke.stapler.export.NotExportableException: class
hudson.plugins.slave_squatter.ReservationTask doesn't have
@ExportedBean
at org.kohsuke.stapler.export.Model.<init>(Model.java:69)
at org.kohsuke.stapler.export.ModelBuilder.get(ModelBuilder.java:48)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:224)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:136)
at org.kohsuke.stapler.export.Property.writeTo(Property.java:113)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:
179)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:
176)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:
176)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:231)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:168)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:136)
at org.kohsuke.stapler.export.Property.writeTo(Property.java:113)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:
179)
at org.kohsuke.stapler.export.Model.writeTo(Model.java:152)
at
org.kohsuke.stapler.ResponseImpl.serveExposedBean(ResponseImpl.java:
199)
at hudson.model.Api.doXml(Api.java:87)
... 65 more

[Winstone 2011/05/12 09:48:34] - Untrapped Error in Servlet
javax.servlet.ServletException:
org.kohsuke.stapler.export.NotExportableException: class
hudson.plugins.slave_squatter.ReservationTask doesn't have
@ExportedBean
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:603)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:646)
at org.kohsuke.stapler.MetaClass$4.doDispatch(MetaClass.java:195)
at
org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:
53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:561)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:646)
at org.kohsuke.stapler.MetaClass$4.doDispatch(MetaClass.java:195)
at
org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:
53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:561)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:646)
at org.kohsuke.stapler.Stapler.invoke(Stapler.java:477)
at org.kohsuke.stapler.Stapler.service(Stapler.java:159)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:45)
at winstone.ServletConfiguration.execute(ServletConfiguration.java:
249)
at winstone.RequestDispatcher.forward(RequestDispatcher.java:335)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:378)
at hudson.util.PluginServletFilter
$1.doFilter(PluginServletFilter.java:94)
at
hudson.plugins.greenballs.GreenBallFilter.doFilter(GreenBallFilter.java:
52)
at hudson.util.PluginServletFilter
$1.doFilter(PluginServletFilter.java:97)
at
net.bull.javamelody.MonitoringFilter.doFilter(MonitoringFilter.java:
157)
at
net.bull.javamelody.MonitoringFilter.doFilter(MonitoringFilter.java:
131)
at
net.bull.javamelody.PluginMonitoringFilter.doFilter(PluginMonitoringFilter.java:
82)
at
org.jvnet.hudson.plugins.monitoring.HudsonMonitoringFilter.doFilter(HudsonMonitoringFilter.java:
84)
at hudson.util.PluginServletFilter
$1.doFilter(PluginServletFilter.java:97)
at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:
86)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:195)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:368)
at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:47)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:195)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:368)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:84)
at
hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:
51)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.ui.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:
166)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.providers.anonymous.AnonymousProcessingFilter.doFilter(AnonymousProcessingFilter.java:
125)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.ui.rememberme.RememberMeProcessingFilter.doFilter(RememberMeProcessingFilter.java:
135)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.ui.AbstractProcessingFilter.doFilter(AbstractProcessingFilter.java:
271)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.ui.basicauth.BasicProcessingFilter.doFilter(BasicProcessingFilter.java:
173)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
org.acegisecurity.context.HttpSessionContextIntegrationFilter.doFilter(HttpSessionContextIntegrationFilter.java:
249)
at
hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:
66)
at hudson.security.ChainedServletFilter
$1.doFilter(ChainedServletFilter.java:87)
at
hudson.security.ChainedServletFilter.doFilter(ChainedServletFilter.java:
76)
at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:164)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:195)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:368)
at
hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:
81)
at winstone.FilterConfiguration.execute(FilterConfiguration.java:195)
at winstone.RequestDispatcher.doFilter(RequestDispatcher.java:368)
at winstone.RequestDispatcher.forward(RequestDispatcher.java:333)
at
winstone.RequestHandlerThread.processRequest(RequestHandlerThread.java:
244)
at winstone.RequestHandlerThread.run(RequestHandlerThread.java:150)
at java.lang.Thread.run(Thread.java:636)
Caused by: org.kohsuke.stapler.export.NotExportableException: class
hudson.plugins.slave_squatter.ReservationTask doesn't have
@ExportedBean
at org.kohsuke.stapler.export.Model.<init>(Model.java:69)
at org.kohsuke.stapler.export.ModelBuilder.get(ModelBuilder.java:48)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:224)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:136)
at org.kohsuke.stapler.export.Property.writeTo(Property.java:113)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:
179)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:
176)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:
176)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:231)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:168)
at org.kohsuke.stapler.export.Property.writeValue(Property.java:136)
at org.kohsuke.stapler.export.Property.writeTo(Property.java:113)
at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:
179)
at org.kohsuke.stapler.export.Model.writeTo(Model.java:152)
at
org.kohsuke.stapler.ResponseImpl.serveExposedBean(ResponseImpl.java:
199)
at hudson.model.Api.doXml(Api.java:87)
at sun.reflect.GeneratedMethodAccessor720.invoke(Unknown Source)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:
43)
at java.lang.reflect.Method.invoke(Method.java:616)
at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:
282)
at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:149)
at
org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:
88)
at org.kohsuke.stapler.MetaClass$1.doDispatch(MetaClass.java:103)
at
org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:
53)
at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:561)
... 56 more

Should I report this to the Jenkins JIRA?

-Pasi