AccessDeniedException logging regression

[PetersNils]

AccessDeniedException logging regression

Since upgrading to Git Parameter version 462.463.v496a_59f698e5 which implements the fix for CVE-2026-57286 we've noticed that requests to the Jenkins API from a user with only Job/Read permission can produce an AccessDeniedException stacktrace in the Jenkins controller log.

The request itself still returns HTTP 200 with valid JSON.

Reproduction steps

1. git-parameter plugin version 462.463.v496a_59f698e5
2. The job contains a Git Parameter plugin parameter
3. The requesting user has Job/Read permission but does not have Job/Build permission

Example Request:

GET /job/<job-name>/api/json

Observed behavior

Given the above conditions we observed the following behavior:

• HTTP response code: 200
• Response body: valid JSON
• The response is missing the GitParameterDefinition entry completely
• Jenkins controller logs an AccessDeniedException stacktrace

Stacktrace

skipping export of net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition@a5ca16
hudson.security.AccessDeniedException3: anonymous is missing the „Element/Build“ permission
    at hudson.security.ACL.checkPermission(ACL.java:79)
    at hudson.security.AccessControlled.checkPermission(AccessControlled.java:52)
    at PluginClassLoader for git-parameter//net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition$DescriptorImpl.doFillValueItems(GitParameterDefinition.java:734)
    at PluginClassLoader for git-parameter//net.uaznia.lukanus.hudson.plugins.gitparameter.GitParameterDefinition.getAllValueItems(GitParameterDefinition.java:237)
    at org.kohsuke.stapler.export.MethodProperty.getValue(MethodProperty.java:75)
Caused: java.lang.reflect.InvocationTargetException
    at org.kohsuke.stapler.export.MethodProperty.getValue(MethodProperty.java:77)
    at org.kohsuke.stapler.export.ExportInterceptor$1.getValue(ExportInterceptor.java:46)
Caused: java.io.IOException: Failed to write allValueItems:null
    at org.kohsuke.stapler.export.ExportInterceptor$1.getValue(ExportInterceptor.java:56)
    at org.kohsuke.stapler.export.Property.writeTo(Property.java:141)
    at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:239)
    at org.kohsuke.stapler.export.Property.writeValue(Property.java:311)
    at org.kohsuke.stapler.export.Property.writeBuffered(Property.java:182)
    at org.kohsuke.stapler.export.Property.writeValue(Property.java:243)
    at org.kohsuke.stapler.export.Property.writeValue(Property.java:176)
    at org.kohsuke.stapler.export.Property.writeTo(Property.java:160)
    at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:239)
    at org.kohsuke.stapler.export.Property.writeValue(Property.java:311)
    at org.kohsuke.stapler.export.Property.writeBuffered(Property.java:182)
    at org.kohsuke.stapler.export.Property.writeValue(Property.java:243)
    at org.kohsuke.stapler.export.Property.writeValue(Property.java:176)
    at org.kohsuke.stapler.export.Property.writeTo(Property.java:160)
    at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:239)
    at org.kohsuke.stapler.export.Model.writeNestedObjectTo(Model.java:235)
    at org.kohsuke.stapler.export.Model.writeTo(Model.java:210)
    at org.kohsuke.stapler.ResponseImpl.writeOne(ResponseImpl.java:350)
    at org.kohsuke.stapler.ResponseImpl.serveExposedBean(ResponseImpl.java:339)
    at org.kohsuke.stapler.ResponseImpl.serveExposedBean(ResponseImpl.java:290)
    at hudson.model.Api.doJsonImpl(Api.java:259)
    at hudson.model.Api.doJson(Api.java:239)
    at java.base/java.lang.invoke.MethodHandle.invokeWithArguments(MethodHandle.java:733)
    at org.kohsuke.stapler.Function$MethodFunction.invoke(Function.java:484)
    at org.kohsuke.stapler.Function$InstanceFunction.invoke(Function.java:497)
    at org.kohsuke.stapler.Function.bindAndInvoke(Function.java:218)
    at org.kohsuke.stapler.Function.bindAndInvokeAndServeResponse(Function.java:140)
    at org.kohsuke.stapler.MetaClass$12.doDispatch(MetaClass.java:686)
    at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
    at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
    at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
    at org.kohsuke.stapler.MetaClass$2.doDispatch(MetaClass.java:244)
    at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
    at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
    at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
    at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:369)
    at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
    at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
    at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
    at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:369)
    at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
    at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
    at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
    at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:369)
    at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
    at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
    at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
    at org.kohsuke.stapler.MetaClass$5.doDispatch(MetaClass.java:369)
    at org.kohsuke.stapler.NameBasedDispatcher.dispatch(NameBasedDispatcher.java:61)
    at org.kohsuke.stapler.Stapler.tryInvoke(Stapler.java:800)
    at org.kohsuke.stapler.Stapler.invoke(Stapler.java:938)
    at org.kohsuke.stapler.Stapler.invoke(Stapler.java:721)
    at org.kohsuke.stapler.Stapler.service(Stapler.java:253)
    at Jenkins Main ClassLoader//jakarta.servlet.http.HttpServlet.service(HttpServlet.java:587)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHolder.handle(ServletHolder.java:783)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$ChainEnd.doFilter(ServletHandler.java:1670)
    at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:200)
    at PluginClassLoader for metrics//jenkins.metrics.impl.MetricsFilter.doFilter(MetricsFilter.java:125)
    at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:197)
    at jenkins.util.HttpServletFilter$1.doFilter(HttpServletFilter.java:77)
    at hudson.util.PluginServletFilter$1.doFilter(PluginServletFilter.java:197)
    at hudson.util.PluginServletFilter.doFilter(PluginServletFilter.java:203)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
    at jenkins.ErrorAttributeFilter.doFilter(ErrorAttributeFilter.java:29)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
    at hudson.security.csrf.CrumbFilter.doFilter(CrumbFilter.java:159)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
    at jenkins.security.csp.impl.CspFilter.doFilter(CspFilter.java:83)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
    at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:94)
    at jenkins.security.AcegiSecurityExceptionFilter.doFilter(AcegiSecurityExceptionFilter.java:52)
    at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
    at hudson.security.UnwrapSecurityExceptionFilter.doFilter(UnwrapSecurityExceptionFilter.java:54)
    at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:125)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119)
    at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:100)
    at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
    at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:150)
    at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:105)
    at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:235)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:229)
    at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
    at jenkins.security.BasicHeaderProcessor.doFilter(BasicHeaderProcessor.java:106)
    at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:117)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
    at hudson.security.HttpSessionContextIntegrationFilter2.doFilter(HttpSessionContextIntegrationFilter2.java:63)
    at hudson.security.ChainedServletFilter2$1.doFilter(ChainedServletFilter2.java:99)
    at hudson.security.ChainedServletFilter2.doFilter(ChainedServletFilter2.java:111)
    at hudson.security.HudsonFilter.doFilter(HudsonFilter.java:173)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
    at org.kohsuke.stapler.UncaughtExceptionFilter.doFilter(UncaughtExceptionFilter.java:26)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
    at hudson.util.CharacterEncodingFilter.doFilter(CharacterEncodingFilter.java:85)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
    at org.kohsuke.stapler.DiagnosticThreadNameFilter.doFilter(DiagnosticThreadNameFilter.java:31)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
    at jenkins.security.SuspiciousRequestFilter.doFilter(SuspiciousRequestFilter.java:38)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.FilterHolder.doFilter(FilterHolder.java:202)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler$Chain.doFilter(ServletHandler.java:1640)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler.doHandle(ServletHandler.java:526)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.handle(ScopedHandler.java:125)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.security.SecurityHandler.handle(SecurityHandler.java:574)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HandlerWrapper.handle(HandlerWrapper.java:124)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextHandle(ScopedHandler.java:195)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.SessionHandler.doHandle(SessionHandler.java:612)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextHandle(ScopedHandler.java:193)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.doHandle(ContextHandler.java:1047)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:162)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.servlet.ServletHandler.doScope(ServletHandler.java:483)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:160)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.SessionHandler.doScope(SessionHandler.java:589)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.nextScope(ScopedHandler.java:160)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.doScope(ContextHandler.java:962)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ScopedHandler.handle(ScopedHandler.java:123)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler.handle(ContextHandler.java:1731)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel$RequestDispatchable.dispatch(HttpChannel.java:1586)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel.dispatch(HttpChannel.java:737)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.HttpChannel.handle(HttpChannel.java:520)
    at Jenkins Main ClassLoader//org.eclipse.jetty.ee9.nested.ContextHandler$CoreContextHandler$CoreToNestedHandler.handle(ContextHandler.java:3059)
    at Jenkins Main ClassLoader//org.eclipse.jetty.server.handler.ContextHandler.handle(ContextHandler.java:1226)
    at Jenkins Main ClassLoader//org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:621)
    at Jenkins Main ClassLoader//org.eclipse.jetty.server.Server.handle(Server.java:197)
    at Jenkins Main ClassLoader//org.eclipse.jetty.server.internal.HttpChannelState$HandlerInvoker.run(HttpChannelState.java:788)
    at Jenkins Main ClassLoader//org.eclipse.jetty.server.internal.HttpConnection.onFillable(HttpConnection.java:420)
    at Jenkins Main ClassLoader//org.eclipse.jetty.server.internal.HttpConnection$FillableCallback.succeeded(HttpConnection.java:1809)
    at Jenkins Main ClassLoader//org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:105)
    at Jenkins Main ClassLoader//org.eclipse.jetty.io.SelectableChannelEndPoint$1.run(SelectableChannelEndPoint.java:54)
    at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:492)
    at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.epcRunTask(AdaptiveExecutionStrategy.java:428)
    at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:401)
    at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:255)
    at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.run(AdaptiveExecutionStrategy.java:204)
    at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:317)
    at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:1009)
    at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.doRunJob(QueuedThreadPool.java:1240)
    at Jenkins Main ClassLoader//org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1194)
    at java.base/java.lang.Thread.run(Thread.java:1583)

Expected behavior

A read-only API request should not produce an exception or stacktrace.

Suspected cause

GitParameterDefinition.getAllValueItems() is exported through the Jenkins API and directly calls doFillValueItems(). The CVE fix added a Job.BUILD permission check to doFillValueItems(). During serialization this check throws an exception for read-only users and Stapler logs the exception before continuing the response.

Additional notes

In our deployment this regression causes gigabytes of log output per day instead of megabytes :/

We've used previous plugin version 462.vdcf3df2ed2ca_ with the exact same request and permissions and haven't experienced the reported behavior.

I'd also like to note that the Security Advisory states:

...
Git Parameter Plugin 462.463.v496a_59f698e5 requires Item/Build permission to populate the list of values for Git parameters.

As noted before the response without the Job/Build permission is missing the GitParameterDefinition entry within parameterDefinitions completely.
I interpret the advisory like the intention was to only strip the entries of the values field in the allValueItems object and not the whole ParametersDefinitionProperty, which would be different to the current behavior.