Extending fix to User.

core/src/main/java/hudson/model/User.java

@@ -50,6 +50,7 @@ import hudson.util.XStream2;
 import java.io.File;
 import java.io.FileFilter;
 import java.io.IOException;
+import java.io.Serializable;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
@@ -731,10 +732,43 @@ public class User extends AbstractModelObject implements AccessControlled, Descr
             throw FormValidation.error(Messages.User_IllegalFullname(fullName));
         }
         if(BulkChange.contains(this))   return;
-        getConfigFile().write(this);
+        synchronized (saving) {
+            saving.add(this);
+        }
+        try {
+            getConfigFile().write(this);
+        } finally {
+            synchronized (saving) {
+                saving.remove(this);
+            }
+        }
         SaveableListener.fireOnChange(this, getConfigFile());
     }
 
+    private static final Set<User> saving = new HashSet<>();
+
+    private Object writeReplace() {
+        synchronized (saving) {
+            if (saving.contains(this)) {
+                return this;
+            } else {
+                LOGGER.log(Level.WARNING, "JENKINS-45892: reference to {0} being saved but not at top level", this);
+                return new Replacer(this);
+            }
+        }
+    }
+
+    /** Not {@link Serializable} for now, since we are only expecting to use this from XStream. */
+    private static class Replacer {
+        private final String id;
+        Replacer(User u) {
+            id = u.getId();
+        }
+        private Object readResolve() {
+            return getById(id, false);
+        }
+    }
+
     /**
      * Deletes the data directory and removes this user from Hudson.
      *

test/src/test/java/hudson/model/UserRestartTest.java

@@ -25,10 +25,13 @@
 package hudson.model;
 
 import hudson.tasks.Mailer;
+import static org.hamcrest.Matchers.containsString;
+import static org.hamcrest.Matchers.not;
 import org.junit.Test;
 import static org.junit.Assert.*;
 import org.junit.Rule;
 import org.junit.runners.model.Statement;
+import org.jvnet.hudson.test.Issue;
 import org.jvnet.hudson.test.RestartableJenkinsRule;
 
 public class UserRestartTest {
@@ -58,4 +61,37 @@ public class UserRestartTest {
         });
     }
 
+    @Issue("JENKINS-45892")
+    @Test
+    public void badSerialization() {
+        rr.addStep(new Statement() {
+            @Override
+            public void evaluate() throws Throwable {
+                rr.j.jenkins.setSecurityRealm(rr.j.createDummySecurityRealm());
+                FreeStyleProject p = rr.j.createFreeStyleProject("p");
+                User u = User.get("pqhacker");
+                u.setFullName("Pat Q. Hacker");
+                u.save();
+                p.addProperty(new BadProperty(u));
+                String text = p.getConfigFile().asString();
+                System.out.println(text);
+                assertThat(text, not(containsString("<fullName>Pat Q. Hacker</fullName>")));
+            }
+        });
+        rr.addStep(new Statement() {
+            @Override
+            public void evaluate() throws Throwable {
+                FreeStyleProject p = rr.j.jenkins.getItemByFullName("p", FreeStyleProject.class);
+                User u = p.getProperty(BadProperty.class).user; // do not inline: call User.get second
+                assertEquals(User.get("pqhacker"), u);
+            }
+        });
+    }
+    static class BadProperty extends JobProperty<FreeStyleProject> {
+        final User user;
+        BadProperty(User user) {
+            this.user = user;
+        }
+    }
+
 }