[JIRA] (JENKINS-42950) credentials-binding-plugin not masking secret text when it includes a single quote

[jgl...@cloudbees.com (JIRA)]

Title: Message Title

Jesse Glick updated JENKINS-42950   Ah yes, this is just Bash being too clever. When you have echo enabled, Bash—but not, say, Ubuntu’s more compliant Dash—will detect command arguments containing ' and present a mockup of a command line that would escape them even if all the mockup elements were manually surrounded with '. Thus echo $USER $PASS is rendered as + echo username7 password'"'"'7 rather than simply + echo username7 password'7 which I suppose is intended to make it easier for you to copy-paste this line into a new script as echo 'username7' 'password'"'"'7' Since output does not literally contain the password, it is not masked. In general, the plugin cannot keep up with the ways in which various tools might decide to mangle secrets before printing them; it keeps it simple and masks secrets only when printed literally. So either disable echoing with set +x or simply avoid passwords with shell metacharacters, ' especially. Jenkins / JENKINS-42950 credentials-binding-plugin not masking secret text when it includes a single quote Change By: Jesse Glick Status: In Review Resolved Resolution: Cannot Reproduce Not A Defect Add Comment   This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.