[JIRA] (JENKINS-50242) withCredentials step masking isn't secure

[andres.pine...@hotmail.com (JIRA)]

Title: Message Title

Andres Pineros created an issue   Jenkins / JENKINS-50242 withCredentials step masking isn't secure Issue Type: Bug Assignee: Unassigned Components: credentials-binding-plugin Created: 2018-03-19 00:32 Environment: Jenkins: 2.111 Plugin: 1.15 Priority: Major Reporter: Andres Pineros A very common use case of Jenkins is to delegate the responsibility of the creation of pipelines to third parties or developers. These external teams should be able to use secrets given to them via Jenkins credentials, but shouldn't be able to visualize the value of the secret. For this use case, withCredentials is broken: node { stage('Break Security') { withCredentials([string(credentialsId: 'AWS_DEFAULT_REGION', variable: 'AWS_DEFAULT_REGION'), string(credentialsId: 'AWS_ACCESS_KEY_ID', variable: 'AWS_ACCESS_KEY_ID'), string(credentialsId: 'AWS_SECRET_ACCESS_KEY', variable: 'AWS_SECRET_ACCESS_KEY')]) { def exposedSecret = "" for(letter in env.AWS_DEFAULT_REGION) { exposedSecret = "$exposedSecret $letter" } echo "$exposedSecret" } } } The secret can be easily viewed. Letting someone work on a pipeline is basically showing them the secrets that pipeline uses. Add Comment   This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.