Fail fast when the frontend sends an invalid class name (#322)

jenkinsci · Mar 14, 2022 · 0275e61 · 0275e61
1 parent 565fa8e
commit 0275e61
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/core/src/main/java/org/kohsuke/stapler/RequestImpl.java b/core/src/main/java/org/kohsuke/stapler/RequestImpl.java
@@ -698,20 +698,35 @@ public Object convertJSON(Object o) {
                 if(l==null) {// single value conversion
                     try {
                         Class actualType = type;
+                        boolean isArray = false;
                         String className = null;
                         if(j.has("stapler-class")) {
+                            if (j.optJSONArray("stapler-class") != null) {
+                                isArray = true;
+                            }
                             // deprecated as of 2.4-jenkins-4 but left here for a while until we are sure nobody uses this
                             className = j.getString("stapler-class");
                             LOGGER.log(FINE, "stapler-class is deprecated in favor of $class: {0}", className);
                         }
                         if(j.has("$class")) {
+                            if (j.optJSONArray("$class") != null) {
+                                isArray = true;
+                            }
                             className = j.getString("$class");
                         }
 
                         if (className != null) {
                             // sub-type is specified in JSON.
                             // note that this can come from malicious clients, so we need to make sure we don't have security issues.
 
+                            if (isArray) {
+                                throw new IllegalArgumentException(
+                                        "The frontend sent an unexpected list of classes ("
+                                                + className
+                                                + ") rather than an expected single class. See"
+                                                + " https://www.jenkins.io/doc/developer/views/table-to-div-migration/"
+                                                + " for more information.");
+                            }
                             ClassLoader cl = stapler.getWebApp().getClassLoader();
                             try {
                                 Class<?> subType = cl.loadClass(className);