jenkinsci / jenkinsci/credentials-plugin
[JENKINS-72442] Warning about "insecure interpolation of sensitive variables" when password parameter is null
- Dominant language
- Java
- Stars
- 134
- Forks
- 258
- Avg merge
- 48m
- Merged PRs (30d)
- 1
Description
Test case:
I have a job A calling a job B.
The job B has the following parameter:
nonStoredPasswordParam('PASSWORD_PARAM', 'A password param')
job A calls the job B using:
def myParam = null
build job: "job-b",
wait: false,
propagate: false,
parameters: [
password(name: 'PASSWORD_PARAM', value: myParam)
]
job B does not do anything with the parameter, but some other variable being used is also "null":
stage('Testing CCAB-2103') {
environment {
MY_NULL_PARAM = "${null}"
}
steps {
script {
log.info("Testing CCAB-2103")
}
}
}
=> will lead to the warning message
The following steps that have been detected may have insecure interpolation of sensitive variables (click here for an explanation):withEnv: [PASSWORD_PARAM]
A solution could be to simply exclude "null" as a sensitive variable.
---
Originally reported by andreaszottmann, imported from: Warning about "insecure interpolation of sensitive variables" when password parameter is null
Raw content of original issue
Test case:
I have a job A calling a job B.
The job B has the following parameter:
nonStoredPasswordParam('PASSWORD_PARAM', 'A password param')
job A calls the job B using:def myParam = null
build job: "job-b",
wait: false,
propagate: false,
parameters: [
password(name: 'PASSWORD_PARAM', value: myParam)
]job B does not do anything with the parameter, but some other variable being used is also "null":
stage('Testing CCAB-2103') {
environment {
MY_NULL_PARAM = "${null}"
}
steps {
script {
log.info("Testing CCAB-2103")
}
}
}=> will lead to the warning message
The following steps that have been detected may have insecure interpolation of sensitive variables (click here for an explanation):withEnv: [PASSWORD_PARAM]A solution could be to simply exclude "null" as a sensitive variable.
Contributor guide
Assessment
This issue has not been assessed yet.