Merge pull request #20 from jenkinsci/JENKINS-37541

[JENKINS-37541] Protect ourselves against deserialization with null binding
jenkinsci · Aug 19, 2016 · 4453a9a · 4453a9a
2 parents ce2641a + ad1bd01
commit 4453a9a
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/pom.xml b/pom.xml
@@ -5,7 +5,7 @@
   <parent>
     <groupId>org.jenkins-ci.plugins</groupId>
     <artifactId>plugin</artifactId>
-    <version>2.9</version>
+    <version>2.14</version>
   </parent>
 
   <artifactId>credentials-binding</artifactId>

diff --git a/src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/SecretBuildWrapper.java b/src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/SecretBuildWrapper.java
@@ -33,6 +33,7 @@
 import hudson.tasks.BuildWrapperDescriptor;
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -42,10 +43,10 @@
 @SuppressWarnings({"rawtypes", "unchecked"}) // inherited from BuildWrapper
 public class SecretBuildWrapper extends BuildWrapper {
 
-    private final List<? extends MultiBinding<?>> bindings;
+    private /*almost final*/ List<? extends MultiBinding<?>> bindings;
 
     @DataBoundConstructor public SecretBuildWrapper(List<? extends MultiBinding<?>> bindings) {
-        this.bindings = bindings;
+        this.bindings = bindings == null ? Collections.<MultiBinding<?>>emptyList() : bindings;
     }
 
     public List<? extends MultiBinding<?>> getBindings() {
@@ -78,6 +79,13 @@ public List<? extends MultiBinding<?>> getBindings() {
         }
     }
 
+    protected Object readResolve() {
+        if (bindings == null) {
+            bindings = Collections.emptyList();
+        }
+        return this;
+    }
+
     @Extension public static class DescriptorImpl extends BuildWrapperDescriptor {
 
         @Override public boolean isApplicable(AbstractProject<?, ?> item) {