[JENKINS-37541] Protect ourselves against deserialization with null b…

…inding
jenkinsci · Aug 19, 2016 · ad1bd01 · ad1bd01
1 parent e2a2dbb
commit ad1bd01
Showing 1 changed file with 10 additions and 2 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/SecretBuildWrapper.java b/src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/SecretBuildWrapper.java
@@ -33,6 +33,7 @@
 import hudson.tasks.BuildWrapperDescriptor;
 import java.io.IOException;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -42,10 +43,10 @@
 @SuppressWarnings({"rawtypes", "unchecked"}) // inherited from BuildWrapper
 public class SecretBuildWrapper extends BuildWrapper {
 
-    private final List<? extends MultiBinding<?>> bindings;
+    private /*almost final*/ List<? extends MultiBinding<?>> bindings;
 
     @DataBoundConstructor public SecretBuildWrapper(List<? extends MultiBinding<?>> bindings) {
-        this.bindings = bindings;
+        this.bindings = bindings == null ? Collections.<MultiBinding<?>>emptyList() : bindings;
     }
 
     public List<? extends MultiBinding<?>> getBindings() {
@@ -78,6 +79,13 @@ public List<? extends MultiBinding<?>> getBindings() {
         }
     }
 
+    protected Object readResolve() {
+        if (bindings == null) {
+            bindings = Collections.emptyList();
+        }
+        return this;
+    }
+
     @Extension public static class DescriptorImpl extends BuildWrapperDescriptor {
 
         @Override public boolean isApplicable(AbstractProject<?, ?> item) {