[JIRA] (JENKINS-61394) Maven top-level target displays passwords with "$" in the log

[uwe.klinger@sap.com (JIRA)]

Uwe Klinger created an issue

Jenkins / JENKINS-61394 Maven top-level target displays passwords with "$" in the log Issue Type: Bug Assignee: Unassigned Components: maven-plugin Created: 2020-03-09 11:58 Environment: org.jenkins-ci.main:jenkins-war: 2.223 maven-plugin: 3.4 Priority: Minor Reporter: Uwe Klinger When using password variables in the "Maven top-level target" step, passwords are revealed if they contain a "$", but with duplicated "$". For example:  Password: a$b Displayed password: a$$b When using the shell step, no password is displayed. See also attached screenshots for further information. I searched the existing tickets but didn't found the same problem. It looks like this is a regression because I couldn't reproduce it on a much older Jenkins version. Thanks, Uwe   Add Comment

This message was sent by Atlassian Jira (v7.13.12#713012-sha1:6e07c38)

[uwe.klinger@sap.com (JIRA)]

Uwe Klinger updated an issue

Jenkins / JENKINS-61394 Maven top-level target displays passwords with "$" in the log

Change By: Uwe Klinger Attachment: job settings.png

Add Comment

[uwe.klinger@sap.com (JIRA)]

Uwe Klinger updated an issue

Jenkins / JENKINS-61394 Maven top-level target displays passwords with "$" in the log

Change By: Uwe Klinger Attachment: output.png

Add Comment

[uwe.klinger@sap.com (JIRA)]

Uwe Klinger updated an issue

Jenkins / JENKINS-61394 Maven top-level target displays passwords with "$" in the log

Change By: Uwe Klinger Attachment: job settings.png

Add Comment

[uwe.klinger@sap.com (JIRA)]

Uwe Klinger updated an issue

Jenkins / JENKINS-61394 Maven top-level target displays passwords with "$" in the log

Change By: Uwe Klinger Attachment: Job configuration.png

Add Comment

[uwe.klinger@sap.com (JIRA)]

Uwe Klinger updated an issue

Jenkins / JENKINS-61394 Maven top-level target displays passwords with "$" in the log Change By: Uwe Klinger

When using password variables in the "Maven top-level target" step, passwords are revealed if they contain a "$", but with duplicated "$". For example:

* Password: a$b * Displayed password: a$$b

When using the shell step, no password is displayed.

See also attached screenshots for further information. an example: # step uses echo -> Escaping ok # step uses maven plugin -> Escaping of passwords with "$" is broken

I searched the existing tickets but didn't found the same problem. It looks like this is a regression because I couldn't reproduce it on a much older Jenkins version. Thanks, Uwe

Add Comment

[hoky841023@gmail.com (JIRA)]

Kuan-Yu Ho commented on JENKINS-61394

Re: Maven top-level target displays passwords with "$" in the log The command which displayed on console is executed before replace variables, it cause the command which displayed on console different from actual executions.

Add Comment

[hoky841023@gmail.com (JIRA)]

Kuan-Yu Ho assigned an issue to Kuan-Yu Ho

Jenkins / JENKINS-61394

Maven top-level target displays passwords with "$" in the log

Change By: Kuan-Yu Ho Assignee: Kuan-Yu Ho

Add Comment