[JENKINS-69781] DurableTaskStep experimental USE_WATCHING breaks secret masking

Dietmar Scheidl created issue - 2022-10-05 11:45

Dietmar Scheidl made changes - 2022-10-05 11:59

Description

Original: When using {{org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING=true}} the sample will show the credentials instead of masking them.

Sample:
{noformat}
pipeline {
    agent {
kubernetes {
}
}

    stages {
        stage('test') {
            steps {
                withVault(
                    [
                        [
                            path: 'some/path',
                            secretValues: [
                                [vaultKey: 'foo'],
                            ]
                        ]
                    ]
                ) {
                    sh 'echo $foo'
                }
            }
        }
    }
}
{noformat}

Using kubernetes agent just for simplicity, but remote call is mandatory. When using controller node, masking is also done correctly.

New: When using {{org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING=true}} the sample will show the credentials instead of masking them.

Sample:
{noformat}
pipeline {
    agent {
kubernetes {
}
}

    stages {
        stage('test') {
            steps {
                withVault(
                    [
                        [
                            path: 'some/path',
                            secretValues: [
                                [vaultKey: 'foo'],
                            ]
                        ]
                    ]
                ) {
                    sh 'echo $foo'
                }
            }
        }
    }
}
{noformat}

Using kubernetes agent just for simplicity, but remote call is mandatory. When using controller node, masking is also done correctly.

Sadly this settings gets enabled by a static code block in opentelemetry-plugin: https://github.com/jenkinsci/opentelemetry-plugin/blob/master/src/main/java/io/jenkins/plugins/opentelemetry/job/log/OtelLogStorageFactory.java#L50

Dietmar Scheidl made changes - 2022-10-05 12:00

Description

Original: When using {{org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING=true}} the sample will show the credentials instead of masking them.

Sample:
{noformat}
pipeline {
    agent {
kubernetes {
}
}

    stages {
        stage('test') {
            steps {
                withVault(
                    [
                        [
                            path: 'some/path',
                            secretValues: [
                                [vaultKey: 'foo'],
                            ]
                        ]
                    ]
                ) {
                    sh 'echo $foo'
                }
            }
        }
    }
}
{noformat}

Using kubernetes agent just for simplicity, but remote call is mandatory. When using controller node, masking is also done correctly.

Sadly this settings gets enabled by a static code block in opentelemetry-plugin: https://github.com/jenkinsci/opentelemetry-plugin/blob/master/src/main/java/io/jenkins/plugins/opentelemetry/job/log/OtelLogStorageFactory.java#L50

New: When using {{org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING=true}} the sample will show the credentials instead of masking them.

Sample:
{noformat}
pipeline {
    agent {
kubernetes {
}
}

    stages {
        stage('test') {
            steps {
                withVault(
                    [
                        [
                            path: 'some/path',
                            secretValues: [
                                [vaultKey: 'foo'],
                            ]
                        ]
                    ]
                ) {
                    sh 'echo $foo'
                }
            }
        }
    }
}
{noformat}

Using kubernetes agent just for simplicity, but remote call is mandatory. When using controller node, masking is also done correctly.

Sadly this setting gets enabled by a static code block in opentelemetry-plugin: https://github.com/jenkinsci/opentelemetry-plugin/blob/master/src/main/java/io/jenkins/plugins/opentelemetry/job/log/OtelLogStorageFactory.java#L50

Dietmar Scheidl made changes - 2022-10-05 13:35

Description

Original: When using {{org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING=true}} the sample will show the credentials instead of masking them.

Sample:
{noformat}
pipeline {
    agent {
kubernetes {
}
}

    stages {
        stage('test') {
            steps {
                withVault(
                    [
                        [
                            path: 'some/path',
                            secretValues: [
                                [vaultKey: 'foo'],
                            ]
                        ]
                    ]
                ) {
                    sh 'echo $foo'
                }
            }
        }
    }
}
{noformat}

Using kubernetes agent just for simplicity, but remote call is mandatory. When using controller node, masking is also done correctly.

Sadly this setting gets enabled by a static code block in opentelemetry-plugin: https://github.com/jenkinsci/opentelemetry-plugin/blob/master/src/main/java/io/jenkins/plugins/opentelemetry/job/log/OtelLogStorageFactory.java#L50

New: When using {{org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING=true}} the sample will show the credentials instead of masking them.

Sample:
{noformat}
pipeline {
    agent {
        kubernetes {
        }
    }

    stages {
        stage('test') {
            steps {
                withVault(
                    [
                        [
                            path: 'some/path',
                            secretValues: [
                                [vaultKey: 'foo'],
                            ]
                        ]
                    ]
                ) {
                    sh 'echo $foo'
                }
            }
        }
    }
}
{noformat}

Using kubernetes agent just for simplicity, but remote call is mandatory. When using controller node, masking is also done correctly.

Sadly this setting gets enabled by a static code block in opentelemetry-plugin: https://github.com/jenkinsci/opentelemetry-plugin/blob/master/src/main/java/io/jenkins/plugins/opentelemetry/job/log/OtelLogStorageFactory.java#L50

Jesse Glick made changes - 2022-10-18 12:51

Component/s

Original: workflow-durable-task-step-plugin [ 21715 ]

Dietmar Scheidl made changes - 2023-05-24 05:29

Remote Link

New: This issue links to "CVE-2023-33001 (Web Link)" [ 28712 ]

Jenkins

Details

Description

Attachments

Issue Links

Activity

People

Dates