Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-23447

Sensitive build variables recorded in EnvInjectSavable and displayed in EnvInjectAction

    XMLWordPrintable

Details

    Description

      If you have a BuildWrapper which overrides makeSensitiveBuildVariables to specify that its additions are to be considered secret, then add an EnvInjectBuilder which adds some unrelated variables, injectedEnvVars.txt includes the sensitive variables (in plaintext) and /job/.../.../injectedEnvVars/ shows them as well.

      Attachments

        Issue Links

          Activity

            Code changed in jenkins
            User: Gregory Boissinot
            Path:
            src/main/java/org/jenkinsci/plugins/envinject/EnvInjectPluginAction.java
            http://jenkins-ci.org/commit/envinject-plugin/65f2715af6445d217e5df8a24bbd179f7841403f
            Log:
            Merge pull request #40 from dshvedchenko/master

            JENKINS-23447 related , avoid NPE if there are no getSensibleVariables()

            Compare: https://github.com/jenkinsci/envinject-plugin/compare/db0d1ef23baf...65f2715af644

            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Gregory Boissinot Path: src/main/java/org/jenkinsci/plugins/envinject/EnvInjectPluginAction.java http://jenkins-ci.org/commit/envinject-plugin/65f2715af6445d217e5df8a24bbd179f7841403f Log: Merge pull request #40 from dshvedchenko/master JENKINS-23447 related , avoid NPE if there are no getSensibleVariables() Compare: https://github.com/jenkinsci/envinject-plugin/compare/db0d1ef23baf...65f2715af644

            if project does not have Sensitive variables, it raises NPE on

            ERROR: Failed to record SCM polling for hudson.model.FreeStyleProject@105707ef[*************]
            java.lang.NullPointerException
            at org.jenkinsci.plugins.envinject.EnvInjectPluginAction$1.transformEntry(EnvInjectPluginAction.java:25)
            at org.jenkinsci.plugins.envinject.EnvInjectPluginAction$1.transformEntry(EnvInjectPluginAction.java:23)

            dshvedchenko Denis Shvedchenko added a comment - if project does not have Sensitive variables, it raises NPE on ERROR: Failed to record SCM polling for hudson.model.FreeStyleProject@105707ef [*************] java.lang.NullPointerException at org.jenkinsci.plugins.envinject.EnvInjectPluginAction$1.transformEntry(EnvInjectPluginAction.java:25) at org.jenkinsci.plugins.envinject.EnvInjectPluginAction$1.transformEntry(EnvInjectPluginAction.java:23)

            Code changed in jenkins
            User: Nicolas De Loof
            Path:
            pom.xml
            src/main/java/org/jenkinsci/plugins/envinject/EnvInjectAction.java
            src/main/java/org/jenkinsci/plugins/envinject/EnvInjectPluginAction.java
            http://jenkins-ci.org/commit/envinject-plugin/d3e2b61c7e858a6f34ec17a40a575e1a82d1274f
            Log:
            JENKINS-23447 only mask sensible data when displayed on UI or persisted on disk

            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Nicolas De Loof Path: pom.xml src/main/java/org/jenkinsci/plugins/envinject/EnvInjectAction.java src/main/java/org/jenkinsci/plugins/envinject/EnvInjectPluginAction.java http://jenkins-ci.org/commit/envinject-plugin/d3e2b61c7e858a6f34ec17a40a575e1a82d1274f Log: JENKINS-23447 only mask sensible data when displayed on UI or persisted on disk

            Code changed in jenkins
            User: Nicolas De Loof
            Path:
            src/main/java/org/jenkinsci/lib/envinject/EnvInjectAction.java
            http://jenkins-ci.org/commit/envinject-lib/e181ac473a9ea3d8b531ff0f061e7ca7071f7d87
            Log:
            JENKINS-23447 only mask sensible data when injectedEnvVars.txt is persisted or exposed on UI

            scm_issue_link SCM/JIRA link daemon added a comment - Code changed in jenkins User: Nicolas De Loof Path: src/main/java/org/jenkinsci/lib/envinject/EnvInjectAction.java http://jenkins-ci.org/commit/envinject-lib/e181ac473a9ea3d8b531ff0f061e7ca7071f7d87 Log: JENKINS-23447 only mask sensible data when injectedEnvVars.txt is persisted or exposed on UI

            ndeloof solved it as part of d50c5a

            schristou Steven Christou added a comment - ndeloof solved it as part of d50c5a

            Do you have any indication of how long it would take to correct this? We have a number or projects that are held up waiting for this vulnerability to be corrected. Thank-You.

            walterk82 Walter Kacynski added a comment - Do you have any indication of how long it would take to correct this? We have a number or projects that are held up waiting for this vulnerability to be corrected. Thank-You.
            jglick Jesse Glick added a comment -

            Even more insidious than I originally thought: the problem occurs even if the job makes no mention of EnvInject. The plugin merely needs to be enabled.

            jglick Jesse Glick added a comment - Even more insidious than I originally thought: the problem occurs even if the job makes no mention of EnvInject. The plugin merely needs to be enabled.
            jglick Jesse Glick added a comment -

            For example install the Credentials Binding plugin (1.0 just released), create a global username/password credentials, then make a job binding those credentials to $AUTH, and add an EnvInject build step adding some other variable, and a shell step running env. Both variables will be set correctly, but injectedEnvVars will show AUTH=user:pass in cleartext despite build.getSensitiveBuildVariables().contains("AUTH").

            jglick Jesse Glick added a comment - For example install the Credentials Binding plugin (1.0 just released), create a global username/password credentials, then make a job binding those credentials to $AUTH , and add an EnvInject build step adding some other variable, and a shell step running env . Both variables will be set correctly, but injectedEnvVars will show AUTH=user:pass in cleartext despite build.getSensitiveBuildVariables().contains("AUTH") .

            People

              ndeloof Nicolas De Loof
              jglick Jesse Glick
              Votes:
              1 Vote for this issue
              Watchers:
              5 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: