[JENKINS-68998] Credential binding password masking is not working for batch (windows batch cmd) when credentials are loaded with configuration as a code in Base64 encoding.

Credential binding password masking is not working for batch (windows batch cmd) when credentials are loaded with configuration as a code in Base64 encoding.

Steps to reproduce:

Create and load test credentials with casc.yaml

1. Create base64 format for password echo "testpassword" | base64

dGVzdHBhc3N3b3JkCg==

2. Test Credentials yaml configuration example

• usernamePassword:
  
  scope: GLOBAL
  
  id: "TST_CREDS"
  
  username: "testusername"
  
  password: "${decodeBase64:dGVzdHBhc3N3b3JkCg==}"
  
  description: "TST_CREDS"

3. Bind Credential in a job and use in a Execute Windows batch command build step

@​echo off

ECHO Test_Username: %usernameUsername% Test_Password: %usernamePassword%:

4. Run the job - password will not be masked.

Test_Username: testusername Test_Password: testpassword

Work around - don't use base64

5. Update credential without base64 encoding

6. Run the job - password will be masked

Test_Username: testusername Test_Password: ****

Note: PowerShell, Bash are not affected by this issue.

Thank you

---
Originally reported by anisig, imported from: Credential binding password masking is not working for batch (windows batch cmd) when credentials are loaded with configuration as a code in Base64 encoding.

• status: Open
  
• priority: Minor
  
• component(s): credentials-binding-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 20251211-141027
  

Raw content of original issue

Credential binding password masking is not working for batch (windows batch cmd) when credentials are loaded with configuration as a code in Base64 encoding.


Steps to reproduce:

Create and load test credentials with casc.yaml

1. Create base64 format for password echo "testpassword" | base64

dGVzdHBhc3N3b3JkCg==

2. Test Credentials yaml configuration example



	
usernamePassword:

  scope: GLOBAL

  id: "TST_CREDS"

  username: "testusername"

  password: "${decodeBase64:dGVzdHBhc3N3b3JkCg==}"

  description: "TST_CREDS"



3. Bind Credential in a job and use in a Execute Windows batch command build step

@echo off

ECHO Test_Username: %usernameUsername% Test_Password: %usernamePassword%:

4. Run the job - password will not be masked.

Test_Username: testusername Test_Password: testpassword


Work around - don't use base64

5. Update credential without base64 encoding

6. Run the job - password will be masked

Test_Username: testusername Test_Password: ****


Note: PowerShell, Bash are not affected by this issue.


Thank you

environment

```
Jenkins 2.346.1 with Credentials Binding Plugin

Version523.vd859a_4b_122e6
```