The way you use credentials plugin is bad, you should never put the password in clear

Takes the credentials and paste it into clear text <div class="Box Box--conden

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

Password in clear text about violation-comments-to-stash-plugin HOT 6 CLOSED

jenkinsci commented on July 25, 2024 1

Password in clear text

from violation-comments-to-stash-plugin.

Comments (6)

tomasbjerre commented on July 25, 2024 1

This is now released in 1.65. Thanks again for this!!

from violation-comments-to-stash-plugin.

jetersen commented on July 25, 2024

Takes the credentials and paste it into clear text

violation-comments-to-stash-plugin/src/main/java/org/jenkinsci/plugins/jvctb/perform/JvctbPerformer.java

Lines 257 to 284 in 0e85c4f

 private static void setCredentialsIfExists( 

 final TaskListener listener, final ViolationsToBitbucketServerConfig configExpanded) { 

 if (configExpanded.isUseUsernamePasswordCredentials()) { 

 if (!isNullOrEmpty(configExpanded.getUsernamePasswordCredentialsId())) { 

 final Optional<StandardUsernamePasswordCredentials> credentials = 

 findCredentials(configExpanded.getUsernamePasswordCredentialsId()); 

 if (credentials.isPresent()) { 

 final String username = 

 checkNotNull( 

 emptyToNull(credentials.get().getUsername()), 

 "Credentials username selected but not set!"); 

 final String password = 

 checkNotNull( 

 emptyToNull(credentials.get().getPassword().getPlainText()), 

 "Credentials password selected but not set!"); 

 configExpanded.setUsername(username); 

 configExpanded.setPassword(password); 

 listener.getLogger().println("Using username and password from credentials"); 

 } else { 

 listener.getLogger().println("Credentials not found!"); 

 return; 

 } 

 } else { 

 listener.getLogger().println("Credentials checked but not selected!"); 

 return; 

 } 

 } 

 }

if I then go and save any configuration afterwards the password is now in clear text on the Jenkins instance

😭

violation-comments-to-stash-plugin/src/main/java/org/jenkinsci/plugins/jvctb/perform/JvctbPerformer.java

Line 235 in 0e85c4f

logger.println(FIELD_PASSWORD + ": " + !isNullOrEmpty(config.getPassword()));

from violation-comments-to-stash-plugin.

tomasbjerre commented on July 25, 2024

Nice! It all sounds very good!

I am generally a bit frustrated about the terrible API:s in Jenkins. And credentials is not an exception. Undocumented, lots of deprications and just very unclear how it should be used. Often feels like things are unnecessary complex... So your refactorings are more than welcome =)

Your findings probably needs fixing in these plugins as well:

from violation-comments-to-stash-plugin.

jetersen commented on July 25, 2024

@tomasbjerre after a little tweaking. I got this.

Current progress on simplified generator:

ViolationsToBitbucketServer([violationConfigs: [[parser: 'ANDROIDLINT', pattern: 'b', reporter: 'a'], [parser: 'CHECKSTYLE', pattern: 'b', reporter: 'a']]])

In the process of deprecating username, password 👍

from violation-comments-to-stash-plugin.

jetersen commented on July 25, 2024

whats the default behaviour between create one comment per violation and create one big comment with all violations

from violation-comments-to-stash-plugin.

tomasbjerre commented on July 25, 2024

I think the first one is most used. I would vote for that being default.

from violation-comments-to-stash-plugin.

Password in clear text about violation-comments-to-stash-plugin HOT 6 CLOSED

Comments (6)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	private static void setCredentialsIfExists(
	final TaskListener listener, final ViolationsToBitbucketServerConfig configExpanded) {
	if (configExpanded.isUseUsernamePasswordCredentials()) {
	if (!isNullOrEmpty(configExpanded.getUsernamePasswordCredentialsId())) {
	final Optional<StandardUsernamePasswordCredentials> credentials =
	findCredentials(configExpanded.getUsernamePasswordCredentialsId());
	if (credentials.isPresent()) {
	final String username =
	checkNotNull(
	emptyToNull(credentials.get().getUsername()),
	"Credentials username selected but not set!");
	final String password =
	checkNotNull(
	emptyToNull(credentials.get().getPassword().getPlainText()),
	"Credentials password selected but not set!");
	configExpanded.setUsername(username);
	configExpanded.setPassword(password);
	listener.getLogger().println("Using username and password from credentials");
	} else {
	listener.getLogger().println("Credentials not found!");
	return;
	}
	} else {
	listener.getLogger().println("Credentials checked but not selected!");
	return;
	}
	}
	}