[JIRA] (JENKINS-59504) Credentials shown in plaintext in Splunk Console Output

[email protected] (JIRA) Fri, 27 Sep 2019 02:30:48 -0700

Title: Message Title

Ted commented on

If you click the "pipeline steps" on job build page, you will find out something like this

The step env step executed first before sendSplunkConsoleLog

 
                                                                  environment {
    userAndPass = credentials('5d407101-23e0-43e7-83b6-badfdd189698')
  }

And because sendSplunkConsoleLog is wrapped inside the scope, it sees the clear text instead of masked ones, just like other steps inside withCredentials such as

 
                                                                        withCredentials([usernameColonPassword(credentialsId: '5d407101-23e0-43e7-83b6-badfdd189698', variable: 'abc')]) {
          // sh step sees the clear text actually
           sh "echo $abc > /tmp/abc.txt" 
        }

I think it is specific to declarative pipeline design: environment step has higher order.

In the contract, we can control the order of execution in scripted pipeline, such as

 
                                                                sendSplunkConsoleLog {
    node {
        echo "testing console log"
        withCredentials([usernameColonPassword(credentialsId: 'blah', variable: 'abc')]) {
           echo abc
           sh "echo $abc"
           echo "hello there"
        }
        echo "done"
    }
}
 
                                                            

Add Comment

This message was sent by Atlassian Jira

--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.202126.1569317096000.6563.1569576600302%40Atlassian.JIRA.

[JIRA] (JENKINS-59504) Credentials shown in plaintext in Splunk Console Output

Reply via email to