[JENKINS-74781] Jenkins asking for same script approval even after script is approved with the latest release plugin

[jenkins-infra-bot]

---

Originally reported by prakashshetty1990, imported from: Jenkins asking for same script approval even after script is approved with the latest release plugin

• status: Open
• priority: Trivial
• component(s): script-security-plugin
• resolution: Unresolved
• votes: 0
• watchers: 3
• imported: 2025-12-09

• environment: 1366.vd44b_49a_5c85c

2 attachments

• image-2024-10-29-11-04-23-808.png

  

• image-2024-10-29-13-27-08-710.png

  

[jenkins-infra-bot]

markewaite:

• Original comment link
• Raw content of original comment:

  I'm unable to duplicate the problem as described.  You'll need to provide much more information so that others can duplicate the issue.  "How to report an issue" describes the type of information needed.  Steps that I took while trying to duplicate the issue:
  
  
  	
  Run the most recent Jenkins weekly release (2.482)
  	
  Complete the setup wizard by installing Pipeline plugins and by creating a user account
  	
  Create a Pipeline that invokes a groovy method that needs approval.  I used
  
  pipeline {
      agent any
      stages {
          stage('get script approval') {
              steps {
                  script {
                      org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval scriptApproval = org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval.get()
                  }
              }
          }
      }
  }
  
  
  	
  Run the Pipeline and confirm that the job fails because script approval is required
  	
  Approve the script from "Manage Jenkins" -> "In-process script approval"
  	
  Run the Pipeline and confirm that the job succeeds
  	
  Confirm that the script is still approved in "Manage Jenkins" -> "In-process script approval"
  	
  Run the Pipeline again and confirm that the job succeeds
  
  If additional information is not provided, this issue will be closed as "Cannot reproduce".
  

I'm unable to duplicate the problem as described. You'll need to provide much more information so that others can duplicate the issue. "How to report an issue" describes the type of information needed. Steps that I took while trying to duplicate the issue:

1. Run the most recent Jenkins weekly release (2.482)
2. Complete the setup wizard by installing Pipeline plugins and by creating a user account
3. Create a Pipeline that invokes a groovy method that needs approval. I used

   pipeline {
       agent any
       stages {
   stage('get script approval') {
       steps {
   script {
       org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval scriptApproval = org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval.get()
   }
       }
   }
       }
   }
   

<li>Run the Pipeline and confirm that the job fails because script approval is required</li>
<li>Approve the script from "Manage Jenkins" -> "In-process script approval"</li>
<li>Run the Pipeline and confirm that the job succeeds</li>
<li>Confirm that the script is still approved in "Manage Jenkins" -> "In-process script approval"</li>
<li>Run the Pipeline again and confirm that the job succeeds</li>

If additional information is not provided, this issue will be closed as "Cannot reproduce".

[jenkins-infra-bot]

prakashshetty1990:

• Original comment link
• Raw content of original comment:

  Hi Mark,
  
  Our pipeline scripts were working fine until we updated the plugin to latest version 1366.vd44b_49a_5c85c.
  
  After updating the plugin we started getting the failure complaining about the script needs to approved as below 
  
  
  
   
  
  We tried to approve the script multiple times and executed the scripts again. and still was not resolved. (Every time we run we see that JsonSluperClassic  is in both "pending signature approvals" and "Signatures already approved" section, )
  
  Later on we installed the previous version of the script security plugin and pipeline got executed successfully.  
  
  We are trying to execute the jenkinsfile from the Bitbucket which uses the groovy.json.JsonSlurperClassic.
  
   
  
  Please let me know if you need more information
  

Hi Mark,

Our pipeline scripts were working fine until we updated the plugin to latest version 1366.vd44b_49a_5c85c.

After updating the plugin we started getting the failure complaining about the script needs to approved as below 

 

We tried to approve the script multiple times and executed the scripts again. and still was not resolved. (Every time we run we see that JsonSluperClassic  is in both "pending signature approvals" and "Signatures already approved" section, )

Later on we installed the previous version of the script security plugin and pipeline got executed successfully.  

We are trying to execute the jenkinsfile from the Bitbucket which uses the groovy.json.JsonSlurperClassic.

 

Please let me know if you need more information

[jenkins-infra-bot]

markewaite:

• Original comment link
• Raw content of original comment:

  Please let me know if you need more information
  
  Please provide an example script that shows the failure.  Others are much more likely to investigate if there is an example script that shows the issue.
  

Please let me know if you need more information

Please provide an example script that shows the failure. Others are much more likely to investigate if there is an example script that shows the issue.

[jenkins-infra-bot]

prakashshetty1990:

• Original comment link
• Raw content of original comment:

  Please find the sample script below.
  
   
  
  
  import groovy.json.JsonSlurperClassic
  
  pipeline {
      agent any
      stages {
          stage('List Credentials') {
              steps {
                  script 
  {
                     input = "[\{\"test\":\"test12\"}
  ]"
                      println(input)
                      def inputJSON = new JsonSlurperClassic().parseText(input)
                      def keys = inputJSON.toSet() as List
                      println(keys)
                      }
                  }
              }
          }
  }
  
   
  

Please find the sample script below.

 

import groovy.json.JsonSlurperClassic

pipeline {
    agent any
    stages {
        stage('List Credentials') {
            steps {
                script

{                    input = "[\{\"test\":\"test12\"}

]"
                    println(input)
                    def inputJSON = new JsonSlurperClassic().parseText(input)
                    def keys = inputJSON.toSet() as List
                    println(keys)
                    }
                }
            }
        }
}

 

[jenkins-infra-bot]

markewaite:

• Original comment link
• Raw content of original comment:

  Thanks. Using that script, I can see the message the first time when it reports that JSONSlurper requires approval. After approval of that class, then the second run wants approval of a method on the JSONSlurper class. Once I've approved those two items, then no further approvals are required.
  
  I see no difference whether I use the previous release 1365.v4778ca_84b_de5 or the most recent release 1366.vd44b_49a_5c85c. With both releases, it requires two approvals for the JSONSlurper.parseText(String) method to be approved. Do you see something different?
  
  I modified your script slightly to be this:
  
  import groovy.json.JsonSlurperClassic
  
  pipeline {
      agent any
      stages {
          stage('Script approval test') {
              steps {
                  script {
                      input = '[{"test":"test12"}]'
                      println(input)
                      def inputJSON = new JsonSlurperClassic().parseText(input)
                      def keys = inputJSON.toSet() as List
                      println(keys)
                  }
              }
          }
      }
  }
  
  
  

Thanks. Using that script, I can see the message the first time when it reports that JSONSlurper requires approval. After approval of that class, then the second run wants approval of a method on the JSONSlurper class. Once I've approved those two items, then no further approvals are required.

I see no difference whether I use the previous release 1365.v4778ca_84b_de5 or the most recent release 1366.vd44b_49a_5c85c. With both releases, it requires two approvals for the JSONSlurper.parseText(String) method to be approved. Do you see something different?

I modified your script slightly to be this:

import groovy.json.JsonSlurperClassic

pipeline {
    agent any
    stages {
stage('Script approval test') {
    steps {
script {
    input = '[{"test":"test12"}]'
    println(input)
    def inputJSON = new JsonSlurperClassic().parseText(input)
    def keys = inputJSON.toSet() as List
    println(keys)
}
    }
}
    }
}

[jenkins-infra-bot]

prakashshetty1990:

• Original comment link
• Raw content of original comment:

  This is the error we were getting in jenkins system console.
  
  
  

This is the error we were getting in jenkins system console.

[jenkins-infra-bot]

markewaite:

• Original comment link
• Raw content of original comment:

  That exception seems to point to StaticWhiteList.parse line175 where the line that is being parsed is not recognized as a valid line.  The first token on the parsed line is expected to be either "method" or "new" or "staticMethod" or "field" or "staticField" but the first token seems to be "SHA512:..."
  
  I think that indicates that the scriptApproval.xml file in the Jenkins home directory has been damaged or contains incorrect content.  After interactive testing of the two test jobs that I was using, my scriptApproval.xml file looks like this:
  
  
  <?xml version='1.1' encoding='UTF-8'?>
  <scriptApproval plugin="script-security@1365.v4778ca_84b_de5">
    <approvedScriptHashes/>
    <approvedSignatures>
      <string>method groovy.json.JsonSlurperClassic parseText java.lang.String</string>
      <string>new groovy.json.JsonSlurperClassic</string>
      <string>staticMethod org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval get</string>
    </approvedSignatures>
    <aclApprovedSignatures/>
    <approvedClasspathEntries/>
    <pendingScripts/>
    <pendingSignatures/>
    <pendingClasspathEntries/>
  </scriptApproval>
  
  
  However, I see in my own archived scriptApproval.xml file, I have lines that starts with "SHA152" as well, though they are in a configuration section called "approvedScriptHashes" and not in the section called "approvedSignatures".
  

That exception seems to point to StaticWhiteList.parse line175 where the line that is being parsed is not recognized as a valid line. The first token on the parsed line is expected to be either "method" or "new" or "staticMethod" or "field" or "staticField" but the first token seems to be "SHA512:..."

I think that indicates that the scriptApproval.xml file in the Jenkins home directory has been damaged or contains incorrect content. After interactive testing of the two test jobs that I was using, my scriptApproval.xml file looks like this:

'1.1' encoding='UTF-8'?>
"script-security@​1365.v4778ca_84b_de5">
  
  
    method groovy.json.JsonSlurperClassic parseText java.lang.String
    new groovy.json.JsonSlurperClassic
    staticMethod org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval get
  
  
  
  
  
  

However, I see in my own archived scriptApproval.xml file, I have lines that starts with "SHA152" as well, though they are in a configuration section called "approvedScriptHashes" and not in the section called "approvedSignatures".

[jenkins-infra-bot]

prakashshetty1990:

• Original comment link
• Raw content of original comment:

  I think with the latest version of script security plugin the entry SHA152 was added. When we downgraded the plugin we had to delete this entry from the scriptApproval.xml for the downgraded version to work.
  
   
  
  I will try to replicate this on my local jenkins and update you.
  

I think with the latest version of script security plugin the entry SHA152 was added. When we downgraded the plugin we had to delete this entry from the scriptApproval.xml for the downgraded version to work.

 

I will try to replicate this on my local jenkins and update you.

[jenkins-infra-bot]

markewaite:

• Original comment link
• Raw content of original comment:

  I think that you have an entry in "approvedSignatures" that belongs in "approvedScriptHashes".  There should be no "SHA512" entries in the XML section for "approvedSignatures"
  

I think that you have an entry in "approvedSignatures" that belongs in "approvedScriptHashes". There should be no "SHA512" entries in the XML section for "approvedSignatures"

[jenkins-infra-bot]

basil:

• Original comment link
• Raw content of original comment:

  Please provide steps to reproduce the problem from scratch on a clean Jenkins installation. For example, "install version X, run script Y, click button Z, and observe that a SHA512 entry is incorrectly present in the approved signatures section."
  

Please provide steps to reproduce the problem from scratch on a clean Jenkins installation. For example, "install version X, run script Y, click button Z, and observe that a SHA512 entry is incorrectly present in the approved signatures section."

[jenkins-infra-bot]

prakashshetty1990:

• Original comment link
• Raw content of original comment:

  In our organization we update all the jenkins plugins every month. and we started observing this issue for the pipeline using groovy.json.JsonSlurperClassic
  
  after the script security plugin was updated last week(same pipeline was working before). And we downgraded the script security plugin to make it work for now.
  
   
  
  I will try to replicate this issue on by installing the jenkins on my personal computer and update you. 
  

In our organization we update all the jenkins plugins every month. and we started observing this issue for the pipeline using groovy.json.JsonSlurperClassic

after the script security plugin was updated last week(same pipeline was working before). And we downgraded the script security plugin to make it work for now.

 

I will try to replicate this issue on by installing the jenkins on my personal computer and update you. 

[jenkins-infra-bot]

basil:

• Original comment link
• Raw content of original comment:

  Thanks prakashshetty1990! Were you able to reproduce the problem?
  

Thanks prakashshetty1990! Were you able to reproduce the problem?