Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-43814

Password parameters should be hidden in pipeline logs by default

XMLWordPrintable

      In a pipeline script when a developer uses `withCredentials` credentials are hidden in logs to reduces the chance of accidental disclosure (see JENKINS-38181)

      When using a password parameter in a job the same concept should be applied to it and it should be impossible to display its value in logs

      A work-around is to use the MaskPasswordsBuildWrapper but it has to be manually done (and it's a bit crappy)

      node {
  wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[password: "${myPassword}", var: 'PASSWORD']]]) {
   println myPassword
   sh 'echo "Hello World ${myPassword}"'
  }
}

       

       

      .

          [JENKINS-43814] Password parameters should be hidden in pipeline logs by default

          Arnaud Héritier created issue -
          Jesse Glick made changes -
          Component/s New: pipeline-model-definition-plugin [ 21706 ]
          Component/s Original: pipeline [ 21692 ]
          Andrew Bayer made changes -
          Link New: This issue relates to JENKINS-44779 [ JENKINS-44779 ]
          James Dumay made changes -
          Labels New: cloudbees-internal-pipeline
          Jesse Glick made changes -
          Link New: This issue is duplicated by JENKINS-36007 [ JENKINS-36007 ]
          Jesse Glick made changes -
          Link Original: This issue is duplicated by JENKINS-36007 [ JENKINS-36007 ]
          Jesse Glick made changes -
          Link New: This issue relates to JENKINS-36007 [ JENKINS-36007 ]
          Andrew Bayer made changes -
          Component/s New: mask-passwords-plugin [ 15761 ]
          Component/s Original: pipeline-model-definition-plugin [ 21706 ]
          Cosmin Stroe made changes -
          Link New: This issue relates to JENKINS-27392 [ JENKINS-27392 ]
          Jesse Glick made changes -
          Link New: This issue relates to HOSTING-679 [ HOSTING-679 ]
          Jesse Glick made changes -
          Link New: This issue relates to JENKINS-57717 [ JENKINS-57717 ]

            Unassigned Unassigned
            aheritier Arnaud Héritier
            Votes:
            6 Vote for this issue
            Watchers:
            11 Start watching this issue

              Created:
              Updated: