[JENKINS-54609] Approve assuming permission check for parameters change actions

Our users have an example of code for change build parameters. It uses "dangerous"

method org.jenkinsci.plugins.workflow.support.steps.build.RunWrapper getRawBuild.

We firstly approve method as "Approve assuming permission check", but error "Scripts not permitted" still appears. Code works only if methods "Approved" (not "Approved assuming permission check"). It is normal behaviour?

code example (need to create in job parameter newparam):

import hudson.model.Actionable

import hudson.model.ParametersAction

import hudson.model.ParameterValue

import hudson.model.StringParameterValue

def paramName = 'newparam'

def paramValue = 'newvalue'

    setParam(paramName, paramValue)

echo ("NEW ${paramName} = ${newparam}")

//======================================================================================================================

void setParam(String paramName, String paramValue) {

    def build = currentBuild.getRawBuild()

    List newParams = new ArrayList<>()

    newParams.add(new StringParameterValue(paramName, paramValue))

    build.addOrReplaceAction(build.getAction(ParametersAction.class).createUpdated(newParams))

}

---
Originally reported by alexanderu, imported from: Approve assuming permission check for parameters change actions

• status: Open
  
• priority: Minor
  
• component(s): script-security-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 2
  
• imported: 2025-12-09
  

Raw content of original issue

Our users have an example of code for change build parameters. It uses "dangerous"


method org.jenkinsci.plugins.workflow.support.steps.build.RunWrapper getRawBuild.


We firstly approve method as "Approve assuming permission check", but error "Scripts not permitted" still appears. Code works only if methods "Approved" (not "Approved assuming permission check"). It is normal behaviour?


code example (need to create in job parameter newparam):



import hudson.model.Actionable

import hudson.model.ParametersAction

import hudson.model.ParameterValue

import hudson.model.StringParameterValue

def paramName = 'newparam'

def paramValue = 'newvalue'

    setParam(paramName, paramValue)

echo ("NEW ${paramName} = ${newparam}")

//======================================================================================================================

void setParam(String paramName, String paramValue) {

    def build = currentBuild.getRawBuild()

    List<ParameterValue> newParams = new ArrayList<>()

    newParams.add(new StringParameterValue(paramName, paramValue))

    build.addOrReplaceAction(build.getAction(ParametersAction.class).createUpdated(newParams))

}

environment

```
jenkins 2.138.2

script-security 1.48
```

1 attachment

- [methods.png](https://issues.jenkins.io/secure/attachment/45148/methods.png)
>