[JENKINS-71760] Unable to create class instance when running Groovy script file

Steps:

1. Run Jenkins in permisive mode.


2. Create a simple job.


3. Add Execute system Groovy script step with any Groovy class that creates it's instance.


4. Add another Execute system Groovy script step running exact same code in a file.

 

Attached example job and example Groovy file I'm running.

For a quick reference this is the Groovy code:

def out = getBinding().out;


class Blog {

    String name

    String subject

     

    Blog() {}

     

    Blog(String name, String subject) {

        this.name = name

        this.subject = subject

    }

    def info(def out, String info) {

      out.println([info, this.name, this.subject]);

    }

}

println("Test test.");

def blog = Blog.newInstance()

blog.info(out, "Test empty");

def blog2 = Blog.newInstance(['mrhaki', 'Groovy'] as Object[])

blog2.info(out, "Test via array");

 

def blog3 = Blog.newInstance([name:'mrhaki', subject: 'Groovy'])

blog3.info(out, "Test with names"); 

Even if creating classes is not supposed to be allowed, the message (in the log) still doesn't make sense to me. Personally, I believe it is wrong to forbid running Groovy from external files, as long as an admin allows it. I can do all kinds of bad stuff through shell anway.

Log:

Running as SYSTEM

Building in workspace /var/www/jenkins-data/workspace/test groovy

Test test.

[Test empty, null, null]

[Test via array, mrhaki, Groovy]

[Test with names, mrhaki, Groovy]

Test test.

[Test empty, null, null]

[Test via array, mrhaki, Groovy]

ERROR: Build step failed with exception

groovy.lang.MissingMethodException: No signature of method: java.lang.Class.newInstance() is applicable for argument types: (java.util.LinkedHashMap) values: [[name:mrhaki, subject:Groovy]]

Possible solutions: newInstance(), newInstance(), newInstance([Ljava.lang.Object;), isInstance(java.lang.Object)

	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onMethodCall(SandboxInterceptor.java:159)

	at org.kohsuke.groovy.sandbox.impl.Checker$1.call(Checker.java:178)

	at org.kohsuke.groovy.sandbox.impl.Checker.checkedCall(Checker.java:182)

	at org.kohsuke.groovy.sandbox.impl.Checker$checkedCall$0.callStatic(Unknown Source)

	at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallStatic(CallSiteArray.java:55)

	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callStatic(AbstractCallSite.java:197)

	at Script1.run(Script1.groovy:27)

	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.runScript(GroovySandbox.java:195)

	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:443)

	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:387)

	at hudson.plugins.groovy.SystemGroovy.run(SystemGroovy.java:95)

	at hudson.plugins.groovy.SystemGroovy.perform(SystemGroovy.java:59)

	at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)

	at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:818)

	at hudson.model.Build$BuildExecution.build(Build.java:199)

	at hudson.model.Build$BuildExecution.doRun(Build.java:164)

	at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:526)

	at hudson.model.Run.execute(Run.java:1900)

	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:44)

	at hudson.model.ResourceController.execute(ResourceController.java:101)

	at hudson.model.Executor.run(Executor.java:442)

Build step 'Execute system Groovy script' marked build as failure

Finished: FAILURE 

---
Originally reported by nux, imported from: Unable to create class instance when running Groovy script file

• status: Open
  
• priority: Major
  
• component(s): script-security-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-09
  

Raw content of original issue

Steps:



	
Run Jenkins in permisive mode.

	
Create a simple job.

	
Add Execute system Groovy script step with any Groovy class that creates it's instance.

	
Add another Execute system Groovy script step running exact same code in a file.



 


Attached example job and example Groovy file I'm running.


For a quick reference this is the Groovy code:



def out = getBinding().out;


class Blog {

    String name

    String subject

     

    Blog() {}

     

    Blog(String name, String subject) {

        this.name = name

        this.subject = subject

    }

    def info(def out, String info) {

      out.println([info, this.name, this.subject]);

    }

}

println("Test test.");

def blog = Blog.newInstance()

blog.info(out, "Test empty");

def blog2 = Blog.newInstance(['mrhaki', 'Groovy'] as Object[])

blog2.info(out, "Test via array");

 

def blog3 = Blog.newInstance([name:'mrhaki', subject: 'Groovy'])

blog3.info(out, "Test with names"); 



Even if creating classes is not supposed to be allowed, the message (in the log) still doesn't make sense to me. Personally, I believe it is wrong to forbid running Groovy from external files, as long as an admin allows it. I can do all kinds of bad stuff through shell anway.


Log:



Running as SYSTEM

Building in workspace /var/www/jenkins-data/workspace/test groovy

Test test.

[Test empty, null, null]

[Test via array, mrhaki, Groovy]

[Test with names, mrhaki, Groovy]

Test test.

[Test empty, null, null]

[Test via array, mrhaki, Groovy]

ERROR: Build step failed with exception

groovy.lang.MissingMethodException: No signature of method: java.lang.Class.newInstance() is applicable for argument types: (java.util.LinkedHashMap) values: [[name:mrhaki, subject:Groovy]]

Possible solutions: newInstance(), newInstance(), newInstance([Ljava.lang.Object;), isInstance(java.lang.Object)

	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onMethodCall(SandboxInterceptor.java:159)

	at org.kohsuke.groovy.sandbox.impl.Checker$1.call(Checker.java:178)

	at org.kohsuke.groovy.sandbox.impl.Checker.checkedCall(Checker.java:182)

	at org.kohsuke.groovy.sandbox.impl.Checker$checkedCall$0.callStatic(Unknown Source)

	at org.codehaus.groovy.runtime.callsite.CallSiteArray.defaultCallStatic(CallSiteArray.java:55)

	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.callStatic(AbstractCallSite.java:197)

	at Script1.run(Script1.groovy:27)

	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.GroovySandbox.runScript(GroovySandbox.java:195)

	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:443)

	at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SecureGroovyScript.evaluate(SecureGroovyScript.java:387)

	at hudson.plugins.groovy.SystemGroovy.run(SystemGroovy.java:95)

	at hudson.plugins.groovy.SystemGroovy.perform(SystemGroovy.java:59)

	at hudson.tasks.BuildStepMonitor$1.perform(BuildStepMonitor.java:20)

	at hudson.model.AbstractBuild$AbstractBuildExecution.perform(AbstractBuild.java:818)

	at hudson.model.Build$BuildExecution.build(Build.java:199)

	at hudson.model.Build$BuildExecution.doRun(Build.java:164)

	at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:526)

	at hudson.model.Run.execute(Run.java:1900)

	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:44)

	at hudson.model.ResourceController.execute(ResourceController.java:101)

	at hudson.model.Executor.run(Executor.java:442)

Build step 'Execute system Groovy script' marked build as failure

Finished: FAILURE 

environment

```
Jenkins 2.401.3

* groovy:453.vcdb_a_c5c99890

* permissive-script-security:0.7
```

2 attachments

- [config.xml](https://issues.jenkins.io/secure/attachment/60942/config.xml)
- [miniClass.groovy](https://issues.jenkins.io/secure/attachment/60941/miniClass.groovy)