[JIRA] (JENKINS-57452) docker.inside allows evaluation of environment variables containing backticks

[jon.s...@gmail.com (JIRA)]

Title: Message Title

Jon Sten commented on JENKINS-57452   Re: docker.inside allows evaluation of environment variables containing backticks We got hit partially by this one, i.e. the part related to capture of container id, in our case the warning "Process leaked file descriptors. See https://jenkins.io/redirect/troubleshooting/process-leaked-file-descriptors for more information" was written on the output stream of the run command, which results in unexpected output:   $ docker run -t -d <<removed>> -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** <<removed>> cat $ docker top "6e82f2a8e6fcfe1460b561479e70b406ad3506d4ba59269f30e588bf972afa9b Process leaked file descriptors. See https://jenkins.io/redirect/troubleshooting/process-leaked-file-descriptors for more information" -eo pid,comm Why we got the Process leaked warning in the first place is a different question, but still it was written to the output stream and docker workflow plugin was unable to handle it. Possible solutions: Use regex to find the hash, e.g. [0-9,a-f]{64} Use stdout redirect on the os level to write the container id to a file, and then read the file None of these solutions are perfect, the first is not future proof if docker decides to change format of their hashes. The later is not great since output redirect can work different on different os, and thus requiring separate command implementations. Note: The root cause for the problem described in the issue description is in my opinion insufficient escaping of the command. My addition just shows that fixing the escaping is not enough as other things can be written on the stream for the docker run command.   Add Comment   This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.199310.1557828129000.3347.1575962340136%40Atlassian.JIRA.