Steps to reproduce.

1. Install both the Mask Passwords and the Build Flow plugins on a new Jenkins server

2. Create a new job "maskpass_child1" with (X) Build a free-style software project.

• check [X] This build is parameterized
• Add Parameter... Non-Stored Password Parameter
• Name: MYPASS
• under Build Environment, check [X] Mask Passwords (and enable global passwords)
• under Build, click Add Build Step, Execute Shell, and add the following shell script:

echo "Test"
echo "MYPASS=$MYPASS"

• Click Save
• click Build Now
• For the MYPASS parameter enter: abc123 and click Build
• view the Console Log for the latest job run, and it should look like:

Started by user jenkins
Building remotely on JenkinsLinuxBuild in workspace /home/jenkins_slave/workspace/maskpass_child1
[maskpass_child1] $ /bin/sh -xe /tmp/hudson1803822529807532224.sh
+ echo Test
Test
+ echo MYPASS=********
MYPASS=********
Notifying upstream projects of job completion
Finished: SUCCESS

• Notice that the values for MYPASS are correctly masked in the echo and stdout

3. To show the problem with the Build Flow plugin, create a new job "maskpass_flow" of type [X] Build Flow

• check [X] This build is parameterized
• Add Parameter... Non-Stored Password Parameter
• Name: MYPASS
• under "Define build flow using flow DSL" enter the following script:

build("maskpass_child1", MYPASS: params["MYPASS"])

• click Save
• click Build Now
• For the MYPASS parameter enter: abc123 and click Build
• view the Console Log for the latest job run to determine the child build ID:

Started by user jenkins
Building remotely on JenkinsLinuxBuild in workspace /home/jenkins_slave/workspace/maskpass_flow Trigger job maskpass_child1
maskpass_child1 #2 completed
Notifying upstream projects of job completion Finished: SUCCESS

• Click the "maskpass_child1 #2" link and then Console Log to view the output:

Started by build flow maskpass_flow#1
Building remotely on JenkinsLinuxBuild in workspace /home/jenkins_slave/workspace/maskpass_child1
[maskpass_child1] $ /bin/sh -xe /tmp/hudson5797906681901645756.sh
+ echo Test
Test
+ echo MYPASS=abc123
MYPASS=abc123
Notifying upstream projects of job completion
Finished: SUCCESS

• ERROR: password values that were masked by directly running maskpass_child1 are shown in the clear when run by the Build Flow plugin.

• Expected output: masked passwords as shown in the Console Log from step #2

+ echo MYPASS=********
MYPASS=********