Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-19830

Masked Password visible as plain text in Msbuild Plugin

    XMLWordPrintable

Details

    Description

            • VERY CRITICAL *****

      Masked Password Clearly visible.

      When Pass build variables as properties is marked as true. Global password will be clearly visible in console output. It was found in version 1.20, it was not in version 1.16.

      Please Fix this issue as soon as possible, as it is a security threat for us.

      For reference attaching image. in which global declared password visible clearly with msbuild command.

      but not visible when i echo in windows batch command.

      Attachments

        Issue Links

          is related to

          Bug - A problem which impairs or prevents the functions of the product. JENKINS-19706 Masked Password Clearly visible as plain text in console output.

          • Critical - Crashes, loss of data, severe memory leak.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. JENKINS-20002 Build Environment plugin will display paramaterized build paramter of type "password" values

          • Major - Major loss of function.
          • Resolved

          Activity

            Ascending order - Click to sort in descending order
            View 5 older comments
            jglick Jesse Glick added a comment -

            Filed pull #10.

            jglick Jesse Glick added a comment - Filed pull #10.
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Jesse Glick
            Path:
            src/main/resources/hudson/plugins/msbuild/MsBuildBuilder/config.jelly
            src/main/webapp/help-BuildVariablesAsProperties.html
            http://jenkins-ci.org/commit/msbuild-plugin/b37dba21830d9343b4d619904ad687428111feb7
            Log:
            JENKINS-19830 Warn about passwords in log.

            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Jesse Glick Path: src/main/resources/hudson/plugins/msbuild/MsBuildBuilder/config.jelly src/main/webapp/help-BuildVariablesAsProperties.html http://jenkins-ci.org/commit/msbuild-plugin/b37dba21830d9343b4d619904ad687428111feb7 Log: JENKINS-19830 Warn about passwords in log.
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Gregory Boissinot
            Path:
            src/main/resources/hudson/plugins/msbuild/MsBuildBuilder/config.jelly
            src/main/webapp/help-BuildVariablesAsProperties.html
            http://jenkins-ci.org/commit/msbuild-plugin/f30df9df32575d31af3211e8f79f5cbea48c69b6
            Log:
            Merge pull request #10 from jglick/mask-args-JENKINS-19830

            [FIXED JENKINS-19830] Warn about passwords in log

            Compare: https://github.com/jenkinsci/msbuild-plugin/compare/b1b89b77e0d8...f30df9df3257

            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Gregory Boissinot Path: src/main/resources/hudson/plugins/msbuild/MsBuildBuilder/config.jelly src/main/webapp/help-BuildVariablesAsProperties.html http://jenkins-ci.org/commit/msbuild-plugin/f30df9df32575d31af3211e8f79f5cbea48c69b6 Log: Merge pull request #10 from jglick/mask-args- JENKINS-19830 [FIXED JENKINS-19830] Warn about passwords in log Compare: https://github.com/jenkinsci/msbuild-plugin/compare/b1b89b77e0d8...f30df9df3257
            jglick Jesse Glick added a comment -

            Just discovered AbstractBuild.getSensitiveBuildVariables which I guess could be used for this purpose.

            jglick Jesse Glick added a comment - Just discovered AbstractBuild.getSensitiveBuildVariables which I guess could be used for this purpose.
            scm_issue_link SCM/JIRA link daemon added a comment -

            Code changed in jenkins
            User: Gregory Boissinot
            Path:
            src/main/java/hudson/plugins/msbuild/MsBuildBuilder.java
            src/main/resources/hudson/plugins/msbuild/MsBuildBuilder/help-buildVariablesAsProperties.html
            src/main/resources/hudson/plugins/msbuild/MsBuildBuilder/help-buildVariablesAsProperties_fr.html
            http://jenkins-ci.org/commit/msbuild-plugin/03fdb89ecc2dd3a0eb06aae099baf5d90f930f49
            Log:
            Fix JENKINS-19830

            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Gregory Boissinot Path: src/main/java/hudson/plugins/msbuild/MsBuildBuilder.java src/main/resources/hudson/plugins/msbuild/MsBuildBuilder/help-buildVariablesAsProperties.html src/main/resources/hudson/plugins/msbuild/MsBuildBuilder/help-buildVariablesAsProperties_fr.html http://jenkins-ci.org/commit/msbuild-plugin/03fdb89ecc2dd3a0eb06aae099baf5d90f930f49 Log: Fix JENKINS-19830

            People

              kdsweeney kdsweeney
              arpitgold Arpit Nagar
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: