{"record":{"id":"b8fe31ca5775b4a4","repo":"jenkinsci/jenkins","slug":"could-not-decode-input","errorCode":null,"errorMessage":"Could not decode input","messagePattern":"Could not decode input","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/hudson/console/AnnotatedLargeText.java","lineNumber":194,"sourceCode":"    private void setContentTypeImpl(StaplerResponse2 rsp) {\n        rsp.setContentType(isHtml() ? \"text/html;charset=UTF-8\" : \"text/plain;charset=UTF-8\");\n    }\n\n    private ConsoleAnnotator<T> createAnnotator(StaplerRequest2 req) throws IOException {\n        try {\n            String base64 = req != null ? req.getHeader(\"X-ConsoleAnnotator\") : null;\n            if (base64 != null) {\n                Cipher sym = PASSING_ANNOTATOR.decrypt();\n\n                try (ObjectInputStream ois = new ObjectInputStreamEx(new GZIPInputStream(\n                        new CipherInputStream(new ByteArrayInputStream(Base64.getDecoder().decode(base64.getBytes(StandardCharsets.UTF_8))), sym)),\n                        Jenkins.get().pluginManager.uberClassLoader)) {\n                    long timestamp = ois.readLong();\n                    if (TimeUnit.HOURS.toMillis(1) > abs(System.currentTimeMillis() - timestamp))\n                        // don't deserialize something too old to prevent a replay attack\n                        return getConsoleAnnotator(ois);\n                } catch (RuntimeException ex) {\n                    throw new IOException(\"Could not decode input\", ex);\n                }\n            }\n        } catch (ClassNotFoundException e) {\n            throw new IOException(e);\n        }\n        // start from scratch\n        return ConsoleAnnotator.initial(context);\n    }\n\n    @SuppressFBWarnings(value = \"OBJECT_DESERIALIZATION\", justification = \"Deserialization is protected by logic.\")\n    private ConsoleAnnotator getConsoleAnnotator(ObjectInputStream ois) throws IOException, ClassNotFoundException {\n        return (ConsoleAnnotator) ois.readObject();\n    }\n\n    @CheckReturnValue\n    @Override\n    public long writeLogTo(long start, Writer w) throws IOException {\n        if (isHtml())","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/jenkinsci/jenkins/blob/2e228ff40b14dbc8b14ffbc6edf0e4383cf744fc/core/src/main/java/hudson/console/AnnotatedLargeText.java#L176-L212","documentation":"IOException thrown by AnnotatedLargeText.createAnnotator when decoding the `X-ConsoleAnnotator` HTTP header (the browser→server progressive-console transport) raises a RuntimeException — bad base64, a cipher/GZIP failure, or a key mismatch on the PASSING_ANNOTATOR secret. The original exception is wrapped and propagated (it does not silently fall back to a fresh annotator).","triggerScenarios":"A console-output poll sends a malformed/stale X-ConsoleAnnotator header; or the Jenkins PASSING_ANNOTATOR secret changed (restart, resharded key, or restored backup) so the cipher stream cannot be decrypted.","commonSituations":"Browser tab left open across a Jenkins restart; a reverse proxy altering/stripping the header; replay/tampering; instance restored from backup with different secrets.","solutions":["Refresh the console page in the browser so a fresh annotator is issued.","If proxied, ensure the reverse proxy forwards X-ConsoleAnnotator verbatim.","For programmatic clients, omit the header (or send a freshly obtained one) rather than reusing an old value."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    annotator = createAnnotator(req);\n} catch (IOException e) {\n    // header undecodable: start fresh instead of failing the page\n    annotator = ConsoleAnnotator.initial(context);\n}","preventionTips":["Do not reuse stale X-ConsoleAnnotator header values across sessions/restarts.","Ensure reverse proxies forward the header unchanged."],"tags":["console","security","http","deserialization"],"backgroundTag":null,"analyzedSha":"2e228ff40b14dbc8b14ffbc6edf0e4383cf744fc","analyzedAt":"2026-08-14T07:07:15.274Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}