Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-23447

Sensitive build variables recorded in EnvInjectSavable and displayed in EnvInjectAction

XMLWordPrintable

      If you have a BuildWrapper which overrides makeSensitiveBuildVariables to specify that its additions are to be considered secret, then add an EnvInjectBuilder which adds some unrelated variables, injectedEnvVars.txt includes the sensitive variables (in plaintext) and /job/.../.../injectedEnvVars/ shows them as well.

          [JENKINS-23447] Sensitive build variables recorded in EnvInjectSavable and displayed in EnvInjectAction

          Jesse Glick created issue -

          Jesse Glick added a comment -

          For example install the Credentials Binding plugin (1.0 just released), create a global username/password credentials, then make a job binding those credentials to $AUTH, and add an EnvInject build step adding some other variable, and a shell step running env. Both variables will be set correctly, but injectedEnvVars will show AUTH=user:pass in cleartext despite build.getSensitiveBuildVariables().contains("AUTH").

          Jesse Glick added a comment - For example install the Credentials Binding plugin (1.0 just released), create a global username/password credentials, then make a job binding those credentials to $AUTH , and add an EnvInject build step adding some other variable, and a shell step running env . Both variables will be set correctly, but injectedEnvVars will show AUTH=user:pass in cleartext despite build.getSensitiveBuildVariables().contains("AUTH") .
          Jesse Glick made changes -
          Link New: This issue is blocking JENKINS-23630 [ JENKINS-23630 ]

          Jesse Glick added a comment -

          Even more insidious than I originally thought: the problem occurs even if the job makes no mention of EnvInject. The plugin merely needs to be enabled.

          Jesse Glick added a comment - Even more insidious than I originally thought: the problem occurs even if the job makes no mention of EnvInject. The plugin merely needs to be enabled.

          Walter Kacynski added a comment -

          Do you have any indication of how long it would take to correct this? We have a number or projects that are held up waiting for this vulnerability to be corrected. Thank-You.

          Walter Kacynski added a comment - Do you have any indication of how long it would take to correct this? We have a number or projects that are held up waiting for this vulnerability to be corrected. Thank-You.
          Jesse Glick made changes -
          Link New: This issue is related to JENKINS-24287 [ JENKINS-24287 ]
          Jesse Glick made changes -
          Link New: This issue is related to JENKINS-4428 [ JENKINS-4428 ]

          Steven Christou added a comment -

          ndeloof solved it as part of d50c5a

          Steven Christou added a comment - ndeloof solved it as part of d50c5a
          Steven Christou made changes -
          Assignee Original: Gregory Boissinot [ gbois ] New: Nicolas De Loof [ ndeloof ]
          Resolution New: Fixed [ 1 ]
          Status Original: Open [ 1 ] New: Resolved [ 5 ]

          SCM/JIRA link daemon added a comment -

          Code changed in jenkins
          User: Nicolas De Loof
          Path:
          src/main/java/org/jenkinsci/lib/envinject/EnvInjectAction.java
          http://jenkins-ci.org/commit/envinject-lib/e181ac473a9ea3d8b531ff0f061e7ca7071f7d87
          Log:
          JENKINS-23447 only mask sensible data when injectedEnvVars.txt is persisted or exposed on UI

          SCM/JIRA link daemon added a comment - Code changed in jenkins User: Nicolas De Loof Path: src/main/java/org/jenkinsci/lib/envinject/EnvInjectAction.java http://jenkins-ci.org/commit/envinject-lib/e181ac473a9ea3d8b531ff0f061e7ca7071f7d87 Log: JENKINS-23447 only mask sensible data when injectedEnvVars.txt is persisted or exposed on UI

            ndeloof Nicolas De Loof
            jglick Jesse Glick
            Votes:
            1 Vote for this issue
            Watchers:
            5 Start watching this issue

              Created:
              Updated:
              Resolved: