From c845fd86e05faa69baef9911d0337f640bd2175e Mon Sep 17 00:00:00 2001
From: Oleg Nenashev <o.v.nenashev@gmail.com>
Date: Tue, 15 May 2018 11:56:13 +0200
Subject: [PATCH] Merge pull request #3439 from oleg-nenashev/bug/JENKINS-51179

[JENKINS-51179] - Provide diagnostics when loading corrupted fingerprint files

(cherry picked from commit 9e64bcdcb4a2cf12d59dfa334e09ffb448d361e9)
---
 .../main/java/hudson/model/Fingerprint.java    |  7 ++++++-
 .../java/hudson/model/FingerprintTest.java     | 18 ++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/core/src/main/java/hudson/model/Fingerprint.java b/core/src/main/java/hudson/model/Fingerprint.java
index 2e0a7ce166..cb130e2c61 100644
--- a/core/src/main/java/hudson/model/Fingerprint.java
+++ b/core/src/main/java/hudson/model/Fingerprint.java
@@ -1366,7 +1366,12 @@ public class Fingerprint implements ModelObject, Saveable {
             start = System.currentTimeMillis();
 
         try {
-            Fingerprint f = (Fingerprint) configFile.read();
+            Object loaded = configFile.read();
+            if (!(loaded instanceof Fingerprint)) {
+                throw new IOException("Unexpected Fingerprint type. Expected " + Fingerprint.class + " or subclass but got "
+                        + (loaded != null ? loaded.getClass() : "null"));
+            }
+            Fingerprint f = (Fingerprint) loaded;
             if(logger.isLoggable(Level.FINE))
                 logger.fine("Loading fingerprint "+file+" took "+(System.currentTimeMillis()-start)+"ms");
             if (f.facets==null)
diff --git a/test/src/test/java/hudson/model/FingerprintTest.java b/test/src/test/java/hudson/model/FingerprintTest.java
index 1aa139db49..ff5214063f 100644
--- a/test/src/test/java/hudson/model/FingerprintTest.java
+++ b/test/src/test/java/hudson/model/FingerprintTest.java
@@ -23,6 +23,7 @@
  */
 package hudson.model;
 
+import hudson.XmlFile;
 import hudson.security.ACL;
 import hudson.security.ACLContext;
 import hudson.security.AuthorizationMatrixProperty;
@@ -30,6 +31,8 @@ import hudson.security.Permission;
 import hudson.security.ProjectMatrixAuthorizationStrategy;
 import hudson.tasks.ArtifactArchiver;
 import hudson.tasks.Fingerprinter;
+
+import java.io.File;
 import java.io.IOException;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -50,6 +53,7 @@ import org.jvnet.hudson.test.MockFolder;
 import org.jvnet.hudson.test.SecuredMockFolder;
 import org.jvnet.hudson.test.WorkspaceCopyFileBuilder;
 
+import static org.hamcrest.Matchers.containsString;
 import static org.junit.Assert.*;
 import static org.hamcrest.Matchers.notNullValue;
 import static org.hamcrest.Matchers.nullValue;
@@ -115,6 +119,20 @@ public class FingerprintTest {
         assertTrue("Usages do not have a reference to " + project, usages.containsKey(project.getName()));
         assertTrue("Usages do not have a reference to " + project2, usages.containsKey(project2.getName()));       
     }
+
+    @Test
+    @Issue("JENKINS-51179")
+    public void shouldThrowIOExceptionWhenFileIsInvalid() throws Exception {
+        XmlFile f = new XmlFile(new File(rule.jenkins.getRootDir(), "foo.xml"));
+        f.write("Hello, world!");
+        try {
+            Fingerprint.load(f.getFile());
+        } catch (IOException ex) {
+            assertThat(ex.getMessage(), containsString("Unexpected Fingerprint type"));
+            return;
+        }
+        fail("Expected IOException");
+    }
     
     @Test
     @Issue("SECURITY-153")