-
Bug
-
Resolution: Not A Defect
-
Minor
-
Jenkins: 2.479.2
Plugin Version: 751.v2e44153c8fe1
##### NOTE ####
I had to put the slack-uploader-plugin as the component. However, this belongs to the slack-notification plugin. It just wasn't listed as an option.
Version: slack-plugin-751.v2e44153c8fe1
File: src/main/java/jenkins/plugins/slack/pipeline/SlackUploadFileRunner.java
Line: 65
Setup Steps:
- Follow this to set up a Slack app
- Navigate to Manage Jenkins > System Log
- Create a new logger
- Name = Slack
- Logger = jenkins.plugins
- Log Level = ALL
- Create a pipeline job to trigger the logging statement
- Here is an example script (File path, channel, and the token id must be changed).
pipeline {
agent any
environment
{ SLACK_CHANNEL = 'all-testing' }stages {
stage('Upload File to Slack') {
steps {
withCredentials([string(credentialsId: 'slack-token', variable: 'SLACK_TOKEN')]) {
script
{ slackUploadFile( filePath: 'C:\\Users\\kyler\\Downloads\\sensitive-info\\business-data.txt.txt', initialComment: 'Uploading sensitive business data to Slack', channel: env.SLACK_CHANNEL ) }}
}
}
}
}
Navigate back to the log and look for the output. Mine is attached. This will log the full file path.
A fix for this could be to say that the upload was successful or to log the base file name.
[JENKINS-75103] CWE-532 In Slack Notification Plugin
I'd usually move this to the SECURITY project, where security issues should be reported, but the Jenkins security team would not consider this to be a vulnerability per https://www.jenkins.io/security/reporting/#non-issues
File paths present in Jenkinsfiles are hardly sensitive information, and especially on the more verbose logging levels, it's rather likely that even credentials might end up being logged as might be necessary to diagnose e.g. connection issues.
Kyler
added a comment - Looking into this, it will appear in a public forum.
I see this
"Never report security issues on GitHub or other public channels (Gitter/Twitter/etc.)
Follow these instruction to report security issues: https://www.jenkins.io/security/#reporting-vulnerabilities"
This brings me back to this Jira or this email jenkinsci-cert@googlegroups.com,
which seems to link to Jira as well.
Kyler
added a comment - Looking into this, it will appear in a public forum.
I see this
"Never report security issues on GitHub or other public channels (Gitter/Twitter/etc.)
Follow these instruction to report security issues: https://www.jenkins.io/security/#reporting-vulnerabilities"
This brings me back to this Jira or this email jenkinsci-cert@googlegroups.com, which seems to link to Jira as well. this Jira
When reporting an issue here, you have the choice of different projects. You reported this in the public "JENKINS" project. As a possible vulnerability, "SECURITY" would have been the correct choice.
Kyler
added a comment - I understand, thank you for clearifying. You're welcome 
FTR I used this as an impulse to propose we replace the links on jenkins.io with a more immediately useful URL that more directly guides reporters: https://github.com/jenkins-infra/jenkins.io/pull/7806
The "Links" section on the right hand side of https://plugins.jenkins.io/slack/ also includes links to report an issue. When the GitHub issue path is chosen, the security page suggests to report through Jira. When the Jira issue path is chosen, it shows a security button that will assign the correct Jira project.
it shows a security button that will assign the correct Jira project
Being improved further in https://github.com/jenkins-infra/jenkins.io/pull/7809 and https://github.com/jenkins-infra/repository-permissions-updater/pull/4256 addressing another issue that some reporters struggle with (plugin IDs being an inconsistent mess doesn't exactly make it easy for them!)
Also noting https://github.com/jenkinsci/.github/pull/144
As this was reported against the wrong component and a comment pointed the reporter to the correct issue tracker, there's no reason to keep this open any longer.
The slack plugin uses github for it's bug tracking. So you should open the problem there. https://github.com/jenkinsci/slack-plugin/issues