[JENKINS-64552] ssh-steps-plugin doesn't allow credentials passed without string interpolation

Type: Improvement
Resolution: Unresolved
Priority: Minor
Component/s: ssh-steps-plugin
Labels:
None

Similar Issues:
Powered by SuggestiMate

Show

Hello,

I have the following pipeline stage, which works great:

stage('Database') {
  steps {
    script {
      remote = createDeployRemote()

      withCredentials([
        usernamePassword(credentialsId: "credential-id", usernameVariable: 'THE_USERNAME', passwordVariable: 'THE_PASSWORD')
      ]) {
        sshCommand remote: remote,
          command: """
            somecommand \
              --username="${THE_USERNAME}" \
              --password="${THE_PASSWORD}"
          """
      }
    }
  }
}

Jenkins complaints with the following warning:

Warning: A secret was passed to "sshCommand" using Groovy String interpolation, which is insecure.

Affected argument(s) used the following variable(s): [THE_USERNAME, THE_PASSWORD]

See https://jenkins.io/redirect/groovy-string-interpolation for details.

I've changed my code to the following:

stage('Database') {
  environment {
    THE_CREDS = credentials("credential-id")
  }

  steps {
    script {
      remote = createDeployRemote()

      sshCommand remote: remote,
        command: """
          printenv

          somecommand \
              --username="\$THE_CREDS_USR" \
              --password="\$THE_CREDS_PSW"
        """
    }
  }
}

It seems that this plugin doesn't pass any of the environment variables to the remote machine.

I think there should be an option to pass all or some pre-defined environment variables to `sshCommand`.

Fabian Grutschus created issue - 2021-01-05 11:54

Idris made changes - 2021-07-02 12:28

Assignee

Original: Naresh Rayapati [ nrayapati ]

New: Bayu Shop [ 0007123456789 ]