Issue
After upgrading my Controller instance to a version equal or higher than 2.361.2.2 my pipelines have started failing with exceptions like the ones listed below:
hudson.remoting.ProxyException: groovy.lang.MissingPropertyException: No such property: XXXX for class: WorkflowScript at org.codehaus.groovy.runtime.ScriptBytecodeAdapter.unwrap(ScriptBytecodeAdapter.java:66) at org.codehaus.groovy.runtime.ScriptBytecodeAdapter.getProperty(ScriptBytecodeAdapter.java:471) at com.cloudbees.groovy.cps.sandbox.DefaultInvoker.getProperty(DefaultInvoker.java:39) at com.cloudbees.groovy.cps.impl.PropertyAccessBlock.rawGet(PropertyAccessBlock.java:20) at WorkflowScript.run(WorkflowScript:11)
Or
java.lang.UnsupportedOperationException: casting arrays to types via constructor is not yet supported
Environment
-
CloudBees CI on modern cloud platforms - managed controller version 2.361.2.2 or higher.
-
CloudBees CI on traditional platforms - client controller version 2.361.2.2 or higher.
-
Pipeline: Groovy Plugin version 2803.v1a_f77ffcc773 or higher.
-
Script Security Plugin version 1184.v85d16b_d851b_3 or higher.
Resolution
The observed issue is the consequence of Jenkins Security Advisory 2022-10-19, a security fix involving the Groovy plugin and the Script security plugin. This fix has an impact on how different elements behave when they are executed inside the Groovy sandbox.
After the fix, things like implicit casting that were initially not intercepted by the Sandbox will not be allowed anymore causing the Groovy code to fail. For a detailed list you can check the specific link here.
The solution to this problem would be to perform explicit casting in your code, along with variable initialization. If you are using arrays of types, you might also consider switching to ArrayList
type as that will also work.
Tested product/plugin versions
-
Pipeline: Groovy Plugin version 2803.v1a_f77ffcc773
-
Script Security Plugin version 1184.v85d16b_d851b_3
-
CloudBees CI on traditional platforms - client controller version 2.361.3.4