[JENKINS-50660] Whitelist: JsonOutput.toJson(Object) not included in generic whitelist

Currently, you cannot output arrays or lists as JSON in pipeline scripts by default. This is because - unlike almost all other overloads of JsonOutput.toJson - JsonOutput.toJson(Object) is not on the generic whitelist.

If this method is somehow problematic from a security POV, feel free to explain and close this issue, but I cannot see any reason to disallow this overload. According to the JavaDoc, this is what it does:

Returns:

"null" for a null value, or a JSON array representation for a collection, array, iterator or enumeration, or representation for other object.

---
Originally reported by mb_o, imported from: Whitelist: JsonOutput.toJson(Object) not included in generic whitelist

• status: Open
  
• priority: Minor
  
• component(s): script-security-plugin
  
• resolution: Unresolved
  
• votes: 1
  
• watchers: 3
  
• imported: 2025-12-09
  

Raw content of original issue

Currently, you cannot output arrays or lists as JSON in pipeline scripts by default. This is because - unlike almost all other overloads of JsonOutput.toJson - JsonOutput.toJson(Object) is not on the generic whitelist.


If this method is somehow problematic from a security POV, feel free to explain and close this issue, but I cannot see any reason to disallow this overload. According to the JavaDoc, this is what it does:




Returns:

"null" for a null value, or a JSON array representation for a collection, array, iterator or enumeration, or representation for other object.

Start by locating the generic whitelist entry points and the JsonOutput.toJson(Object) overload. Verify how whitelist entries are tested, then ensure arrays and lists can be converted to JSON by default without introducing a security regression.

Written by the indexing model from the issue text.