Why is Jenkins running a shared pipeline library inside the sandbox?

Question

I've created a git repo with the following file located at src/com/me:

package com.me
import com.cloudbees.groovy.cps.NonCPS

class JobTriggerInfo implements Serializable {
    def script
    JobTriggerInfo(script)
    {
         this.script = script
    }

    // Source originally from: 
    //   https://hopstorawpointers.blogspot.com/2016/10/performing-nightly-build-steps-with.html
    @NonCPS
    wasStartedByTimer() {
        def startedByTimer = false
        try {
            def buildCauses = script.currentBuild.rawBuild.getCauses()
            for ( buildCause in buildCauses ) {
                if (buildCause != null) {
                    def causeDescription = buildCause.getShortDescription()
                    script.echo "shortDescription: ${causeDescription}"
                    if (causeDescription.contains("Started by timer")) {
                        startedByTimer = true
                    }
                }
            }
        } catch(theError) {
            script.echo "Error getting build cause"
        }
        return startedByTimer
    }
}

I then added that git repo to the "Global Pipeline Libraries" section in Manage Jenkins -> Configure System.

Then I created a simple pipeline project with the following pipeline script:

@Library('JSL') 
import com.me.JobTriggerInfo
node {
   stage('Preparation') { 
           echo 'Hello World'
           startedByTimer = false 
           script {
               startedByTimer = new com.me.JobTriggerInfo(this).wasStartedByTimer
           }   
            echo 'Was started by timer?'
            echo startedByTimer.toString()
   }
}

When I run the job, it fails with:

org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use method groovy.lang.GroovyObject getProperty java.lang.String (com.me.JobTriggerInfo.wasStartedByTimer)

My understanding is that a Global Pipeline Library will run outside the sandbox, based on the official Jenkins docs.

What am I missing? What do I need to do to get this code to run from a Global Pipeline Library and not in a sandbox?

I'm a bit wondering about your `script` stanza. This is actually part of declarative pipelines. Not sure, if this has any negative effect. — StephenKing, Jan 30 '18 at 05:27
Have you tried it without the `toString()` call, thus only `echo startedByTimer`? — StephenKing, Jan 30 '18 at 05:31
Both great ideas. But, the problem was I was missing parenthesis at the end of the line in the script stanza. I changed it to: startedByTimer = new com.me.JobTriggerInfo(this).wasStartedByTimer(), and now it works! I have no idea what that error message is trying to say, but at least it is working. — Erik Shreve, Jan 30 '18 at 12:18

score 1 · Accepted Answer · edited Jan 30 '18 at 13:48

1

The root cause was missing parenthesis in my script. The line in the script stanza needed to be:

startedByTimer = new com.me.JobTriggerInfo(this).wasStartedByTimer()

The confusing thing was the error message reported gave no direct indication that this was the problem.

edited Jan 30 '18 at 13:48

StephenKing

36,187
11
83
112

answered Jan 30 '18 at 13:01

Erik Shreve

174
7

The error messages are difficult decipher because of the dynamic nature of Groovy and how Jenkins compiles and executes your code. – mkobit Jan 30 '18 at 14:01

Why is Jenkins running a shared pipeline library inside the sandbox?

1 Answers1