[JENKINS-64057] Whitelist XmlUtil and a few java.util scripts

We would like to whitelist the following signatures:

• staticMethod groovy.xml.XmlUtil escapeXml java.lang.String


• new java.util.concurrent.LinkedBlockingQueue


• method java.util.concurrent.BlockingQueue poll long java.util.concurrent.TimeUnit


• staticField java.util.concurrent.TimeUnit MILLISECONDS


• staticField java.util.concurrent.TimeUnit SECONDS


• new java.util.TreeMap

All of these signatures are utility classes and hence, it should be safe to whitelist them. 

---
Originally reported by dasanjan1296, imported from: Whitelist XmlUtil and a few java.util scripts

• assignee: dasanjan1296
  
• status: In Progress
  
• priority: Minor
  
• component(s): script-security-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-09
  

Raw content of original issue

We would like to whitelist the following signatures:



	
staticMethod groovy.xml.XmlUtil escapeXml java.lang.String

	
new java.util.concurrent.LinkedBlockingQueue

	
method java.util.concurrent.BlockingQueue poll long java.util.concurrent.TimeUnit

	
staticField java.util.concurrent.TimeUnit MILLISECONDS

	
staticField java.util.concurrent.TimeUnit SECONDS

	
new java.util.TreeMap



All of these signatures are utility classes and hence, it should be safe to whitelist them.