[JENKINS-43814] Password parameters should be hidden in pipeline logs by default

In a pipeline script when a developer uses `withCredentials` credentials are hidden in logs to reduces the chance of accidental disclosure (see JENKINS-38181">JENKINS-38181)

When using a password parameter in a job the same concept should be applied to it and it should be impossible to display its value in logs

A work-around is to use the MaskPasswordsBuildWrapper but it has to be manually done (and it's a bit crappy)

node {

  wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[password: "${myPassword}", var: 'PASSWORD']]]) {

   println myPassword

   sh 'echo "Hello World ${myPassword}"'

  }

}

.

---
Originally reported by aheritier, imported from: Password parameters should be hidden in pipeline logs by default

• status: Open
  
• priority: Minor
  
• component(s): credentials-binding-plugin, mask-passwords-plugin, redacted-password-parameters-plugin
  
• label(s): cloudbees-internal-pipeline
  
• resolution: Unresolved
  
• votes: 6
  
• watchers: 11
  
• imported: 20251211-141027
  

In a pipeline script when a developer uses `withCredentials` credentials are hidden in logs to reduces the chance of accidental disclosure (see JENKINS-38181)


When using a password parameter in a job the same concept should be applied to it and it should be impossible to display its value in logs


A work-around is to use the MaskPasswordsBuildWrapper but it has to be manually done (and it's a bit crappy)



node {

  wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[password: "${myPassword}", var: 'PASSWORD']]]) {

   println myPassword

   sh 'echo "Hello World ${myPassword}"'

  }

}



 


 


.