Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-44594

withCredentials usernamecolonPassword does not mask variable in sh step script

    Details

    • Similar Issues:

      Description

      I am running the following:

      node{
       stage ("Use credentials") {
        withCredentials([usernameColonPassword(credentialsId: 'myApiTokenId', variable: 'credentials')]) {
              echo "$credentials"
      
              //making this call does not mask credentials
              sh returnStdout:true, script: "curl -sko /dev/null -w %{http_code} \"https://example.com/path\" --user $credentials"
              }
          }
      }
      

      OUTPUT:

      
      
      [Pipeline] node
      Running on master in /var/lib/jenkins/workspace/Test Pipeline
      [Pipeline] {
      [Pipeline] stage
      [Pipeline] { (Check if test job is valid)
      [Pipeline] withCredentials
      [Pipeline] {
      [Pipeline] echo
      ****
      [Pipeline] sh
      [Test Pipeline] Running shell script
      + curl -sko /dev/null -w '%{http_code}' https://fpajenkinstest.wdf.sap.corp/job/i856200TestJob --user myusername:4985641987298791451542
      [Pipeline] }
      [Pipeline] // withCredentials
      [Pipeline] }
      [Pipeline] // stage
      [Pipeline] }
      [Pipeline] // node
      [Pipeline] End of Pipeline
      Finished: SUCCESS
      

      Expected:
      Not have credentials exposed in logs.

      Interestingly, if I use the UsernamePasswordMultiBinding class the username will be masked but not password.

        Attachments

          Activity

          Hide
          jglick Jesse Glick added a comment -

          Mangled issue formatting, hard to reconstruct what your script actually was. Minimal self-contained steps to reproduce please.

          To start with, you probably wanted to pass credentials as environment variables, not via Groovy string interpolation. (So ' not ".)

          Show
          jglick Jesse Glick added a comment - Mangled issue formatting, hard to reconstruct what your script actually was. Minimal self-contained steps to reproduce please. To start with, you probably wanted to pass credentials as environment variables, not via Groovy string interpolation. (So ' not " .)
          Hide
          jglick Jesse Glick added a comment -

          Tried to reproduce in a functional test without success.

          Show
          jglick Jesse Glick added a comment - Tried to reproduce in a functional test without success.
          Hide
          hhui Herman H added a comment - - edited

          Hi Jesse,

          I will close this issue. Seems I am unable to reproduce the bug now.
          Thanks,
          Herman

          Show
          hhui Herman H added a comment - - edited Hi Jesse, I will close this issue. Seems I am unable to reproduce the bug now. Thanks, Herman
          Hide
          jglick Jesse Glick added a comment -

          …fixing resolution

          Show
          jglick Jesse Glick added a comment - …fixing resolution

            People

            • Assignee:
              Unassigned
              Reporter:
              hhui Herman H
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: