[JENKINS-37936] Whitelist.all() fails to include dynamically installed plugins

Noted here. An example: run Jenkins with some plugins including script-security loaded from the start; then dynamically install docker-workflow and dependencies, and try to use it. You get

...

[Pipeline] End of Pipeline

org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use new org.jenkinsci.plugins.docker.commons.credentials.DockerRegistryEndpoint java.lang.String java.lang.String

	at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectNew(StaticWhitelist.java:185)

	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onNewInstance(SandboxInterceptor.java:130)

	at org.kohsuke.groovy.sandbox.impl.Checker$3.call(Checker.java:191)

	at org.kohsuke.groovy.sandbox.impl.Checker.checkedConstructor(Checker.java:188)

	at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.constructorCall(SandboxInvoker.java:19)

	at org.jenkinsci.plugins.docker.workflow.Docker$Image.toQualifiedImageName(jar:file:/var/jenkins_home/plugins/docker-workflow/WEB-INF/lib/docker-workflow.jar!/org/jenkinsci/plugins/docker/workflow/Docker.groovy:108)

	at org.jenkinsci.plugins.docker.workflow.Docker$Image.imageName(jar:file:/var/jenkins_home/plugins/docker-workflow/WEB-INF/lib/docker-workflow.jar!/org/jenkinsci/plugins/docker/workflow/Docker.groovy:112)

	at org.jenkinsci.plugins.docker.workflow.Docker$Image.pull(jar:file:/var/jenkins_home/plugins/docker-workflow/WEB-INF/lib/docker-workflow.jar!/org/jenkinsci/plugins/docker/workflow/Docker.groovy:132)

	at org.jenkinsci.plugins.docker.workflow.Docker.node(jar:file:/var/jenkins_home/plugins/docker-workflow/WEB-INF/lib/docker-workflow.jar!/org/jenkinsci/plugins/docker/workflow/Docker.groovy:63)

	at org.jenkinsci.plugins.docker.workflow.Docker$Image.pull(jar:file:/var/jenkins_home/plugins/docker-workflow/WEB-INF/lib/docker-workflow.jar!/org/jenkinsci/plugins/docker/workflow/Docker.groovy:131)

	at WorkflowScript.run(WorkflowScript:5)

	at ...

The workaround is to restart.

---
Originally reported by jglick, imported from: Whitelist.all() fails to include dynamically installed plugins

• assignee: jglick
  
• status: Open
  
• priority: Major
  
• component(s): script-security-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 3
  
• imported: 2025-12-09
  

Raw content of original issue

Noted here. An example: run Jenkins with some plugins including script-security loaded from the start; then dynamically install docker-workflow and dependencies, and try to use it. You get




...

[Pipeline] End of Pipeline

org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use new org.jenkinsci.plugins.docker.commons.credentials.DockerRegistryEndpoint java.lang.String java.lang.String

	at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectNew(StaticWhitelist.java:185)

	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onNewInstance(SandboxInterceptor.java:130)

	at org.kohsuke.groovy.sandbox.impl.Checker$3.call(Checker.java:191)

	at org.kohsuke.groovy.sandbox.impl.Checker.checkedConstructor(Checker.java:188)

	at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.constructorCall(SandboxInvoker.java:19)

	at org.jenkinsci.plugins.docker.workflow.Docker$Image.toQualifiedImageName(jar:file:/var/jenkins_home/plugins/docker-workflow/WEB-INF/lib/docker-workflow.jar!/org/jenkinsci/plugins/docker/workflow/Docker.groovy:108)

	at org.jenkinsci.plugins.docker.workflow.Docker$Image.imageName(jar:file:/var/jenkins_home/plugins/docker-workflow/WEB-INF/lib/docker-workflow.jar!/org/jenkinsci/plugins/docker/workflow/Docker.groovy:112)

	at org.jenkinsci.plugins.docker.workflow.Docker$Image.pull(jar:file:/var/jenkins_home/plugins/docker-workflow/WEB-INF/lib/docker-workflow.jar!/org/jenkinsci/plugins/docker/workflow/Docker.groovy:132)

	at org.jenkinsci.plugins.docker.workflow.Docker.node(jar:file:/var/jenkins_home/plugins/docker-workflow/WEB-INF/lib/docker-workflow.jar!/org/jenkinsci/plugins/docker/workflow/Docker.groovy:63)

	at org.jenkinsci.plugins.docker.workflow.Docker$Image.pull(jar:file:/var/jenkins_home/plugins/docker-workflow/WEB-INF/lib/docker-workflow.jar!/org/jenkinsci/plugins/docker/workflow/Docker.groovy:131)

	at WorkflowScript.run(WorkflowScript:5)

	at ...





The workaround is to restart.