jenkinsci/jenkins · warning · SecurityException

invalid iconSize

Error message

invalid iconSize

What it means

validateIconSize throws SecurityException when the provided iconSize string does not match the regex \d+x\d+ (e.g., '16x16', '32x32'). This guards against malformed input used to construct icon dimension parameters in Jenkins UI rendering. It is a SecurityException (not IllegalArgumentException) because iconSize typically arrives from HTTP request parameters, making it part of the request validation surface.

Source

Thrown at core/src/main/java/hudson/Functions.java:672

        Cookie c = getCookie(req, name);
        if (c == null || c.getValue() == null) return defaultValue;
        return c.getValue();
    }

    /**
     * @deprecated use {@link #getCookie(HttpServletRequest, String, String)}
     */
    @Deprecated
    public static String getCookie(javax.servlet.http.HttpServletRequest req, String name, String defaultValue) {
        return getCookie(HttpServletRequestWrapper.toJakartaHttpServletRequest(req), name, defaultValue);
    }

    private static final Pattern ICON_SIZE = Pattern.compile("\\d+x\\d+");

    @Restricted(NoExternalUse.class)
    public static String validateIconSize(String iconSize) throws SecurityException {
        if (!ICON_SIZE.matcher(iconSize).matches()) {
            throw new SecurityException("invalid iconSize");
        }
        return iconSize;
    }

    /**
     * No longer used, to be removed after enough plugins have adopted a version of the test harness with
     * <a href="https://github.com/jenkinsci/jenkins-test-harness/pull/874">jenkins-test-harness/pull/874</a> in it.
     *
     * @deprecated removed without replacement
     */
    @SuppressFBWarnings(value = "MS_SHOULD_BE_FINAL", justification = "for script console")
    @Deprecated(forRemoval = true, since = "TODO")
    public static boolean DEBUG_YUI;

    /**
     * Creates a sub map by using the given range (both ends inclusive).
     */
    public static <V> SortedMap<Integer, V> filter(SortedMap<Integer, V> map, String from, String to) {

View on GitHub (pinned to 2e228ff40b)

Solutions

1. Sanitize the iconSize input to match \d+x\d+ before passing it to validateIconSize.
2. Provide a sensible default (e.g., '24x24') when the input is blank or malformed.
3. Catch SecurityException at the request boundary and return a 400 error with a helpful message.

Example fix

// before
String iconSize = req.getParameter("iconSize");
Functions.validateIconSize(iconSize);

// after — normalize before validating
String iconSize = req.getParameter("iconSize");
if (iconSize == null || !iconSize.matches("\\d+x\\d+")) {
    iconSize = "24x24";
}

private static final Pattern VALID_ICON_SIZE = Pattern.compile("\\d+x\\d+");
public static String sanitizeIconSize(String input) {
    if (input != null && VALID_ICON_SIZE.matcher(input).matches()) {
        return input;
    }
    return "24x24";
}

public static boolean isValidIconSize(String s) {
    return s != null && s.matches("\\d+x\\d+");
}

try {
    Functions.validateIconSize(iconSize);
} catch (SecurityException e) {
    iconSize = "24x24"; // fall back to default
}

When it happens

Trigger: An HTTP request parameter or configuration value for icon size that does not conform to the NxM pattern, e.g., '16', '16x', 'x16', '16x16x16', or containing non-numeric characters.

Common situations: A plugin or REST API consumer passing an icon size from user input without sanitization, a stale bookmark/URL with a truncated or corrupted iconSize query parameter, or a configuration file with a malformed value.

Related errors

• Restart is not supported, please manually restart this insta
• Null value not allowed as an environment variable: ${key}
• Zip ${zipFile.getPath()} contains illegal file name that bre
• Ambiguous plugin: {0}
• No such plugin: {0}

AI-assisted analysis of jenkinsci/jenkins@2e228ff40b (2026-08-14). Data as JSON: /api/errors/d3cc91e8f89391af. Report an issue: GitHub.