[JIRA] (JENKINS-56486) Make some methods in the Script Security blacklist unapprovable

[dnusb...@cloudbees.com (JIRA)]

Title: Message Title

Devin Nusbaum created an issue   Jenkins / JENKINS-56486 Make some methods in the Script Security blacklist unapprovable Issue Type: Improvement Assignee: Andrew Bayer Components: script-security-plugin Created: 2019-03-08 16:49 Labels: pipeline Priority: Minor Reporter: Devin Nusbaum The script-security plugin already has a blacklist of dangerous method signatures that admins should probably not approve. Methods in this blacklist provide an extra warning when they are being approved, but perhaps that warning is not severe enough, as I have heard multiple reports of users accidentally causing a denial of service attack on their Jenkins instance with a Pipeline that runs System.exit. Some ideas: Make methods which are very unlikely to have legitimate use cases even in an environment where only admins are writing sandboxed scripts unable to be approved, such as System.exit (could be opt-in or opt-out with a system property?). For RejectedAccessExceptions where isDangerous returns true, provide per-signature documentation on the issues, and require the user to re-type the method signature or wait 10 seconds before they can approve the signature in the hope that providing the user with a better understanding of the problems will keep them from approving these methods. Create an admin monitor that warns when blacklisted methods are in the approved list, and gives admins a one-click way to unapprove them. In this case, some kind of additional warning is also likely needed to prevent admins from breaking running jobs without realizing. Add Comment   This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.