Lock contention in Script Security ProxyWhitelist cache

Article ID:4411445207963
1 minute readKnowledge base

Issue

  • The Jenkins controller thread dump shows lots of threads like the following and eventually becomes unresponsive:

Running CpsFlowExecution[Owner[XXXXXXX #X]]" #100000 daemon prio=5 os_prio=0 tid=0x0000000000000000 nid=0x000 runnable [0x000000000000000]
   java.lang.Thread.State: RUNNABLE
    at java.util.WeakHashMap.put(WeakHashMap.java:453)
    at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.ProxyWhitelist.reset(ProxyWhitelist.java:123)
    at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.ProxyWhitelist.<init>(ProxyWhitelist.java:75)
    at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.ProxyWhitelist.<init>(ProxyWhitelist.java:154)
    at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.runScript(GroovySandbox.java:160)
    at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:370)
    [...]

Environment

Related Issues

Explanation

This is caused by a bug in the Script Security plugin that use a WeakHashMap as a cache when checking on sandboxed script but does not properly handle synchronized access to it. When the issue happens, one thread enters an infinite loop and blocks any following access.

Workaround

When impacted, the only workaround is to restart the controller.

Resolution

Upgrade Script Security to version 1.78 - available in CloudBees CI since version 2.303.1.5.