[JENKINS-56948] Whitelist Enum.valueOf()

Using valueOf from known classes (Boolean.valueOf , etc.) are allowed (see source generic-whitelist).

But for custom Enum, we have to approve. Now because we cannot override valueOf, this method is very secure. Because we can't authorize all valueOf from all existing Enum in the world, we could just allow Enum.valueOf(Class enumType, String name).

---
Originally reported by antoinetran, imported from: Whitelist Enum.valueOf()

• status: Open
  
• priority: Minor
  
• component(s): script-security-plugin
  
• resolution: Unresolved
  
• votes: 1
  
• watchers: 2
  
• imported: 2025-12-09
  

Raw content of original issue

Using valueOf from known classes (Boolean.valueOf , etc.) are allowed (see source generic-whitelist).


But for custom Enum, we have to approve. Now because we cannot override valueOf, this method is very secure. Because we can't authorize all valueOf from all existing Enum in the world, we could just allow Enum.valueOf(Class<T> enumType, String name).

• environment: script-security-plugin 1.56 (latest as of now)