whitelist replaceAll(pattern, String)

[ysmaoui]

adding whitelisting for String.replaceAll(pattern, String)

Testing done

Submitter checklist

Beta Give feedback

1. Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
2. Ensure that the pull request title represents the desired changelog entry
3. Please describe what you did
4. Link to relevant issues in GitHub or Jira
5. Link to relevant pull requests, esp. upstream and downstream changes
6. Ensure you have provided tests - that demonstrates feature works or fixes the issue

[jglick]

Note that these are not currently usable in Pipeline: https://github.com/jenkinsci/workflow-cps-plugin/blob/7141c520ff447a70876d806df9a6c159d12525c9/dgm-builder/src/main/resources/com/cloudbees/groovy/cps/tool/translatable.txt#L183-L186

[jglick]

This is deprecated: https://github.com/apache/groovy/blob/GROOVY_2_4_21/src/main/org/codehaus/groovy/runtime/StringGroovyMethods.java#L2613-L2620

Since String implements CharSequence, the sandbox should not be calling this.

I would recommend adding unit tests demonstrating that an entry in this whitelist is actually required.

I suspect StaticWhitelistTest is failing to mechanically detect useless entries.

[jglick]

🤷 Either way, should be harmless to allow it.

[dwnusbaum]

Note that these are not currently usable in Pipeline: https://github.com/jenkinsci/workflow-cps-plugin/blob/7141c520ff447a70876d806df9a6c159d12525c9/dgm-builder/src/main/resources/com/cloudbees/groovy/cps/tool/translatable.txt#L183-L186

I don't think they need to be translated because they don't have a Closure (or Comparator, etc.) parameter.