Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-27631

Do not even temporarily save secrets in Workflow build record

XMLWordPrintable

      Currently when you use withCredentials with e.g. UsernamePasswordMultiBinding, the secret is saved in program.dat for the duration of the block. It is later removed, but it would be safer if it were guaranteed to never be persisted at all. That seems to require an API change: either in EnvVars to allow a given variable to be directly marked as secret and thus to be persisted only via Secret, or by lifting up sensitiveBuildVariables from AbstractBuild to Run, or by allowing BodyInvoker.withContext to provide something like an environment variable factory rather than a raw EnvVars.

          [JENKINS-27631] Do not even temporarily save secrets in Workflow build record

          Jesse Glick created issue -
          Jesse Glick made changes -
          Remote Link New: This issue links to "PR 5 (Web Link)" [ 12186 ]
          Jesse Glick made changes -
          Link New: This issue is related to JENKINS-26128 [ JENKINS-26128 ]
          Jesse Glick made changes -
          Status Original: Open [ 1 ] New: In Progress [ 3 ]
          Jesse Glick made changes -
          Remote Link New: This issue links to "PR 6 (Web Link)" [ 12202 ]
          SCM/JIRA link daemon made changes -
          Resolution New: Fixed [ 1 ]
          Status Original: In Progress [ 3 ] New: Resolved [ 5 ]
          Jesse Glick made changes -
          Link New: This issue is related to JENKINS-28719 [ JENKINS-28719 ]
          R. Tyler Croy made changes -
          Workflow Original: JNJira [ 161843 ] New: JNJira + In-Review [ 196881 ]
          Andrew Bayer made changes -
          Labels Original: api security workflow New: api pipeline security workflow
          Andrew Bayer made changes -
          Labels Original: api pipeline security workflow New: api pipeline security

            jglick Jesse Glick
            jglick Jesse Glick
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Created:
              Updated:
              Resolved: