[JENKINS-75595] Credentials are not masked when they end with a whitespace

Hi,

We are using Jenkins version 2.492.3 and are experiencing the following issue:

If we use the withCredentials syntax and refer to a credential that ends with a whitespace; the build logs reveal the actual value of the credential when they are for example used in an sh script.

Obviously, the credential shouldn't have been created with a whitespace in the first place. We didn't notice this earlier as the build itself did not fail since the whitespace character is just ignored by the shell script that is being executed.

I see 2 potential fixes:

• when trying to save a credential with a whitespace; make sure the user is aware of this before trying to save it (so he/she at least is aware of this)


• update the credentials-binding-plugin to handle cases where the credential ends with a whitespace so they are still correctly masked

---
Originally reported by davysteegen, imported from: Credentials are not masked when they end with a whitespace

• status: Open
  
• priority: Minor
  
• component(s): credentials-binding-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 2
  
• imported: 20251211-141027
  

Raw content of original issue

Hi,


We are using Jenkins version 2.492.3 and are experiencing the following issue:


If we use the withCredentials syntax and refer to a credential that ends with a whitespace; the build logs reveal the actual value of the credential when they are for example used in an sh script.

Obviously, the credential shouldn't have been created with a whitespace in the first place. We didn't notice this earlier as the build itself did not fail since the whitespace character is just ignored by the shell script that is being executed.


I see 2 potential fixes:



	
when trying to save a credential with a whitespace; make sure the user is aware of this before trying to save it (so he/she at least is aware of this)

	
update the credentials-binding-plugin to handle cases where the credential ends with a whitespace so they are still correctly masked