Admin error banners are not displayed: "Forbidden method invocation: java.util.concurrent.ConcurrentHashMap.entrySet()" blocked by FreeMarker allowlist

XMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: Low
    • 12.1.13
    • Affects Version/s: 12.1.12
    • Component/s: User Interface
    • None
    • Severity 2 - Major

      Issue Summary

      Administrator error banners (for example "Bamboo failed to run the backup on DATE. See the logs for further details.") are not displayed. Rendering the banner fails because the FreeMarker template calls java.util.concurrent.ConcurrentHashMap.entrySet(), which is not included in Bamboo's FreeMarker allowlist.

      This affects every admin-level error message, not only backup failures.

      This is reproducible on Data Center: Yes

      Steps to Reproduce

      1. Cause any admin-level error. For example, make a scheduled backup fail (see the related backup bug).
      2. Log in as an administrator and open any page, e.g. a plan result page.

      Expected Results

      A banner is shown at the top of the page:
      Bamboo failed to run the backup on 22 Oct 2026. See the logs for further details.
      with an Acknowledge link.

      Actual Results

      No banner is shown. Each page load logs the following error (twice per page):

      ERROR [http-nio-8085-exec-22 url: /bamboo/browse/PROJ-PLAN-5, /bamboo/chain/result/viewChainResult.action; user: admin] [runtime] Error executing FreeMarker template
freemarker.core._TemplateModelException: Java method "concurrent.ConcurrentHashMap.entrySet()" threw an exception when invoked on concurrent.ConcurrentHashMap object "{backup.error.failed=Bamboo failed to run the backup on 22 Oct 2026.  See the logs for further details.}"; see cause exception in the Java stack trace.
----
FTL stack trace ("~" means nesting-related):
	- Failed at: list adminErrors.entrySet() as error  [in template "fragments/showAdminErrors.ftl" at line 6, column 5]
	- Reached through: include "../showAdminErrors.ftl"  [in template "fragments/decorator/systemstatebanner.ftl" at line 31, column 5]
	- Reached through: include "/fragments/showAdminErrors...  [in template "decorators/resultDecorator.ftl" at line 18, column 1]
----
...
Caused by: java.lang.IllegalAccessException: Forbidden method invocation: java.util.concurrent.ConcurrentHashMap.entrySet()
	at com.atlassian.bamboo.freemarker.allowlist.BambooFreemarkerAllowlistBeansWrapper.invokeMethod(BambooFreemarkerAllowlistBeansWrapper.java:83)
	at freemarker.ext.beans.SimpleMethodModel.exec(SimpleMethodModel.java:73)

      Because the banner is not rendered, the Acknowledge link is not available and the error keeps being logged on every page load until Bamboo is restarted.

      Workaround

      1. Take a backup of <BAMBOO_INSATLL_DIR>/atlassian-bamboo/WEB-INF/classes/freemarker-allowlist.properties
      2. Add the below method to the end of the file like below:

      ,\ 
java.util.concurrent.ConcurrentHashMap.entrySet()

      3. Restart the Bamboo

              Assignee:
              Marcin Gardias
              Reporter:
              Jyothi Charupalli
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated: