[JENKINS-73268] Calling constructors not allowed anymore in global shared libraries

Global shared libraries that should be trusted (and not sandboxed) are not able to call constructors anymore. This used to work in the past.

This could be related to the recent security fixes of the script security plugin: https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341

Logged error:

```
Scripts not permitted to use new java.lang.IllegalArgumentException java.lang.String. Administrators can decide whether to approve or reject this signature.
Also: org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: df27b5ff-68cc-474f-af39-c7d8a785eee4
org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use new java.lang.IllegalArgumentException java.lang.String
at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectNew(StaticWhitelist.java:253)
at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onNewInstance(SandboxInterceptor.java:198)
at org.kohsuke.groovy.sandbox.impl.Checker$3.call(Checker.java:227)
at org.kohsuke.groovy.sandbox.impl.Checker.checkedConstructor(Checker.java:232)
at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.constructorCall(SandboxInvoker.java:21)
at org.jenkinsci.plugins.workflow.cps.LoggingInvoker.constructorCall(LoggingInvoker.java:110)
at com.REDACTED.REDACTED.buildstep.Deploy.parseStepSpecificConfig(Deploy.groovy:183)
at com.REDACTED.REDACTED.BuildStep.parseConfig(BuildStep.groovy:48)
at deploy.call(deploy.groovy:6)
at WorkflowScript.run(WorkflowScript:70)
at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.callClosureForMapEntry(CpsDefaultGroovyMethods:5361)
at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.each(CpsDefaultGroovyMethods:2202)
at WorkflowScript.run(WorkflowScript:56)
at ___cps.transform___(Native Method)
at com.cloudbees.groovy.cps.impl.FunctionCallBlock$ContinuationImpl.dispatchOrArg(FunctionCallBlock.java:100)
at com.cloudbees.groovy.cps.impl.FunctionCallBlock$ContinuationImpl.fixArg(FunctionCallBlock.java:85)
at jdk.internal.reflect.GeneratedMethodAccessor537.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.base/java.lang.reflect.Method.invoke(Unknown Source)
at com.cloudbees.groovy.cps.impl.ContinuationPtr$ContinuationImpl.receive(ContinuationPtr.java:72)
at com.cloudbees.groovy.cps.impl.ConstantBlock.eval(ConstantBlock.java:21)
at com.cloudbees.groovy.cps.Next.step(Next.java:83)
at com.cloudbees.groovy.cps.Continuable.run0(Continuable.java:147)
at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.access$001(SandboxContinuable.java:17)
at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.run0(SandboxContinuable.java:49)
at org.jenkinsci.plugins.workflow.cps.CpsThread.runNextChunk(CpsThread.java:180)
at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.run(CpsThreadGroup.java:423)
at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:331)
at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:295)
at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService.lambda$wrap$4(CpsVmExecutorService.java:136)
at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
at hudson.remoting.SingleLaneExecutorService$1.run(SingleLaneExecutorService.java:139)
at jenkins.util.ContextResettingExecutorService$1.run(ContextResettingExecutorService.java:28)
at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:68)
at jenkins.util.ErrorLoggingExecutorService.lambda$wrap$0(ErrorLoggingExecutorService.java:51)
at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)
at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$1.call(CpsVmExecutorService.java:53)
at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$1.call(CpsVmExecutorService.java:50)
at org.codehaus.groovy.runtime.GroovyCategorySupport$ThreadCategoryInfo.use(GroovyCategorySupport.java:136)
at org.codehaus.groovy.runtime.GroovyCategorySupport.use(GroovyCategorySupport.java:275)
at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService.lambda$categoryThreadFactory$0(CpsVmExecutorService.java:50)
at java.base/java.lang.Thread.run(Unknown Source)

```

---
Originally reported by pascalhofmann, imported from: Calling constructors not allowed anymore in global shared libraries

• status: Open
  
• priority: Minor
  
• component(s): script-security-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-09
  

Raw content of original issue

Global shared libraries that should be trusted (and not sandboxed) are not able to call constructors anymore. This used to work in the past.


This could be related to the recent security fixes of the script security plugin: https://www.jenkins.io/security/advisory/2024-05-02/#SECURITY-3341


Logged error:



 Scripts not permitted to use new java.lang.IllegalArgumentException java.lang.String. Administrators can decide whether to approve or reject this signature.

 Also:   org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: df27b5ff-68cc-474f-af39-c7d8a785eee4

 org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use new java.lang.IllegalArgumentException java.lang.String

    at org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectNew(StaticWhitelist.java:253)

    at org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onNewInstance(SandboxInterceptor.java:198)

    at org.kohsuke.groovy.sandbox.impl.Checker$3.call(Checker.java:227)

    at org.kohsuke.groovy.sandbox.impl.Checker.checkedConstructor(Checker.java:232)

    at com.cloudbees.groovy.cps.sandbox.SandboxInvoker.constructorCall(SandboxInvoker.java:21)

    at org.jenkinsci.plugins.workflow.cps.LoggingInvoker.constructorCall(LoggingInvoker.java:110)

    at com.REDACTED.REDACTED.buildstep.Deploy.parseStepSpecificConfig(Deploy.groovy:183)

    at com.REDACTED.REDACTED.BuildStep.parseConfig(BuildStep.groovy:48)

    at deploy.call(deploy.groovy:6)

    at WorkflowScript.run(WorkflowScript:70)

    at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.callClosureForMapEntry(CpsDefaultGroovyMethods:5361)

    at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.each(CpsDefaultGroovyMethods:2202)

    at WorkflowScript.run(WorkflowScript:56)

    at ___cps.transform___(Native Method)

    at com.cloudbees.groovy.cps.impl.FunctionCallBlock$ContinuationImpl.dispatchOrArg(FunctionCallBlock.java:100)

    at com.cloudbees.groovy.cps.impl.FunctionCallBlock$ContinuationImpl.fixArg(FunctionCallBlock.java:85)

    at jdk.internal.reflect.GeneratedMethodAccessor537.invoke(Unknown Source)

    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)

    at java.base/java.lang.reflect.Method.invoke(Unknown Source)

    at com.cloudbees.groovy.cps.impl.ContinuationPtr$ContinuationImpl.receive(ContinuationPtr.java:72)

    at com.cloudbees.groovy.cps.impl.ConstantBlock.eval(ConstantBlock.java:21)

    at com.cloudbees.groovy.cps.Next.step(Next.java:83)

    at com.cloudbees.groovy.cps.Continuable.run0(Continuable.java:147)

    at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.access$001(SandboxContinuable.java:17)

    at org.jenkinsci.plugins.workflow.cps.SandboxContinuable.run0(SandboxContinuable.java:49)

    at org.jenkinsci.plugins.workflow.cps.CpsThread.runNextChunk(CpsThread.java:180)

    at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup.run(CpsThreadGroup.java:423)

    at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:331)

    at org.jenkinsci.plugins.workflow.cps.CpsThreadGroup$2.call(CpsThreadGroup.java:295)

    at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService.lambda$wrap$4(CpsVmExecutorService.java:136)

    at java.base/java.util.concurrent.FutureTask.run(Unknown Source)

    at hudson.remoting.SingleLaneExecutorService$1.run(SingleLaneExecutorService.java:139)

    at jenkins.util.ContextResettingExecutorService$1.run(ContextResettingExecutorService.java:28)

    at jenkins.security.ImpersonatingExecutorService$1.run(ImpersonatingExecutorService.java:68)

    at jenkins.util.ErrorLoggingExecutorService.lambda$wrap$0(ErrorLoggingExecutorService.java:51)

    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source)

    at java.base/java.util.concurrent.FutureTask.run(Unknown Source)

    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)

    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

    at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$1.call(CpsVmExecutorService.java:53)

    at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService$1.call(CpsVmExecutorService.java:50)

    at org.codehaus.groovy.runtime.GroovyCategorySupport$ThreadCategoryInfo.use(GroovyCategorySupport.java:136)

    at org.codehaus.groovy.runtime.GroovyCategorySupport.use(GroovyCategorySupport.java:275)

    at org.jenkinsci.plugins.workflow.cps.CpsVmExecutorService.lambda$categoryThreadFactory$0(CpsVmExecutorService.java:50)

    at java.base/java.lang.Thread.run(Unknown Source)

environment

```
Jenkins Version 2.452.1

Script Security Plugin

Version 1341.va_2819b_414686

Pipeline: Groovy

Version 3894.3896.vca_2c931e7935
```