The DefectDojo Jenkins Plugin copies scan artifacts generated on a remote agent to the Jenkins controller before uploading them to DefectDojo.

During testing, I observed that:

1. Artifacts are copied into: <JENKINS_HOME>\temp-upload-dir\

1. The copied file uses the original artifact filename (for example dependency-check-report.xml, sonarqube-vulnerabilities.json, trivy-vulnerabilities.json).
2. The temporary files remain in temp-upload-dir after a successful upload and are not removed.

In addition, concurrent builds appear to copy files to the same destination path when the artifact filenames are identical.

Although I have not reproduced an incorrect upload, this behavior appears to allow concurrent executions to target the same temporary filename.

Steps to Reproduce

1. Configure a Jenkins pipeline using the DefectDojo Plugin.

Example:
stage('Upload Reports to DefectDojo') {
    steps {
        defectDojoPublisher(
            artifact: 'sonarqube-vulnerabilities.json',
            productName: "${env.JOB_NAME}",
            engagementName: "${env.gitlabSourceBranch}",
            scanType: 'SonarQube Scan',
            autoCreateProducts: true
        )

        defectDojoPublisher(
            artifact: 'dependency-check-report.xml',
            productName: "${env.JOB_NAME}",
            engagementName: "${env.gitlabSourceBranch}",
            scanType: 'Dependency Check Scan',
            autoCreateProducts: true
        )

        defectDojoPublisher(
            artifact: 'trivy-vulnerabilities.json',
            productName: "${env.JOB_NAME}",
            engagementName: "${env.gitlabSourceBranch}",
            scanType: 'Trivy Scan',
            autoCreateProducts: true
        )
    }
}

1. Execute the pipeline on a remote Jenkins agent.
2. Observe the controller log.

Example:

[DefectDojo] Artifact on agent node

[DefectDojo] Copying artifact
/home/ubuntu/jenkins/workspace/Test-Project1/dependency-check-report.xml

from agent to master

C:\ProgramData\Jenkins\.jenkins\temp-upload-dir\dependency-check-report.xml

1. After the upload completes, inspect: <JENKINS_HOME>\temp-upload-dir

1. Run two concurrent builds of the same pipeline (or different pipelines producing reports with identical filenames).

Actual Result

• The plugin copies artifacts into: <JENKINS_HOME>\temp-upload-dir\<artifact-name>

Examples:

temp-upload-dir\
    sonarqube-vulnerabilities.json
    dependency-check-report.xml
    trivy-vulnerabilities.json

• These files remain after the upload completes.
• Concurrent builds copy artifacts with identical filenames to the same directory.

Example log excerpts from two concurrent builds:

Build #1

Copying artifact
/home/.../Test-Project1/dependency-check-report.xml

to

C:\ProgramData\Jenkins\.jenkins\temp-upload-dir\dependency-check-report.xml

Build #2

Copying artifact
/home/.../Test-Project2/dependency-check-report.xml

to

C:\ProgramData\Jenkins\.jenkins\temp-upload-dir\dependency-check-report.xml

Expected Result

The plugin should:

• create a unique temporary file or build-specific temporary directory for each upload, avoiding reuse of deterministic filenames across concurrent executions.
• remove temporary files after the upload completes (including in failure scenarios).

Possible approaches include:

• Files.createTempFile()
• Files.createTempDirectory()
• A build-specific directory such as: temp-upload-dir/<build-id>/

Additional Information

During testing:

• Jenkins correctly allocated separate workspaces for concurrent builds:
  • Test-Project1
  • Test-Project2

• However, both builds copied artifacts into the same controller directory using identical filenames.
• Uploads completed successfully, and I did not observe an incorrect upload. Therefore, I cannot confirm data corruption.
• The concern is that concurrent executions may target the same temporary file before upload completion, depending on timing.
• Additionally, temporary files appear to accumulate indefinitely because they are not removed after upload.