[JIRA] [credentials-plugin] (JENKINS-33314) Credentials plugin shouldn't expose the password through groovy scripting

[fbelz...@gmail.com (JIRA)]

Title: Message Title

Félix Belzunce Arcos created an issue   Jenkins / JENKINS-33314 Credentials plugin shouldn't expose the password through groovy scripting Issue Type: Bug Assignee: stephenconnolly Components: credentials-plugin Created: 04/Mar/16 7:50 AM Priority: Minor Reporter: Félix Belzunce Arcos All admins on a Jenkins instance might be able to do: credential.getProperties() Which will return something like: [password:test1, class:class com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl, id:main-id, descriptor:com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl$DescriptorImpl@228dc1d9, scope:GLOBAL, description:test-id, username:test] Some users see this behaviour like pretty dangerous because even administrators shouldn't be able to get the password un-encrypted like that. https://wiki.jenkins-ci.org/display/JENKINS/Script+Security+Plugin can help here, but doesn't look like a good solution neither. Anyway, I am not sure if there is a good solution here. Add Comment   This message was sent by Atlassian JIRA (v6.4.2#64017-sha1:e244265) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.