M2 Release Plugin - mask scm password issue
177 views
Skip to first unread message
Andreas
Mar 30, 2015, 5:16:50 AM3/30/15
to jenkins...@googlegroups.com
Hi,
I've a issue with password disclosure when using the M2 Release Plugin and entering the password.
During the release build the SCM Password is passed to a child maven instance and unfortunately dumped in plain text (not masked) to the log output. I would expect that this password is masked using the 'Default' Jenkins mechanism but it is not.
As a easy test I've changed the goal to be executed as "Release goals and options" to "help:system". If I now start a release build and enter scm username/password. I can read in the Log:
I've a issue with password disclosure when using the M2 Release Plugin and entering the password.
During the release build the SCM Password is passed to a child maven instance and unfortunately dumped in plain text (not masked) to the log output. I would expect that this password is masked using the 'Default' Jenkins mechanism but it is not.
As a easy test I've changed the goal to be executed as "Release goals and options" to "help:system". If I now start a release build and enter scm username/password. I can read in the Log:
<===[JENKINS REMOTING CAPACITY]===>channel startedExecuting Maven: -B -f /export/sbs/jenkins/home/workspace/am-test/pom.xml -DdevelopmentVersion=2-SNAPSHOT -DreleaseVersion=1 -Dusername=jenkins help:system -Dpassword=*********[INFO] Scanning for projects...[INFO] --- maven-help-plugin:2.2:system (default-cli) @ my-module --- ...
=============================================================================== System Properties =============================================================================== JOB_NAME=am-test ...password=mysecretpassword
...
Bug or usage error? Any hint would be appreciated.
Kind Regards,
Andreas.
Andreas
Mar 30, 2015, 11:51:25 AM3/30/15
to jenkins...@googlegroups.com
Me again....
My current workaround is to additionally expose the password to the environment by setting "SCM password environment variable" in the advanced options of the m2release plugin. In this case the password is also stored as PasswordParameterValue and thus detected as to be masked by the EnvInject plugin.
Kind Regards, Andreas.
My current workaround is to additionally expose the password to the environment by setting "SCM password environment variable" in the advanced options of the m2release plugin. In this case the password is also stored as PasswordParameterValue and thus detected as to be masked by the EnvInject plugin.
Kind Regards, Andreas.
Eric Wood
Mar 30, 2015, 4:06:25 PM3/30/15
to jenkins...@googlegroups.com
try using the masked password plugin.
Me again....
My current workaround is to additionally expose the password to the environment by setting "SCM password environment variable" in the advanced options of the m2release plugin. In this case the password is also stored as PasswordParameterValue and thus detected as to be masked by the EnvInject plugin.
Kind Regards, Andreas.
Am Montag, 30. März 2015 11:16:50 UTC+2 schrieb Andreas:
My current workaround is to additionally expose the password to the environment by setting "SCM password environment variable" in the advanced options of the m2release plugin. In this case the password is also stored as PasswordParameterValue and thus detected as to be masked by the EnvInject plugin.
Kind Regards, Andreas.
Am Montag, 30. März 2015 11:16:50 UTC+2 schrieb Andreas:
Hi,
I've a issue with password disclosure when using the M2 Release Plugin and entering the password.
During the release build the SCM Password is passed to a child maven instance and unfortunately dumped in plain text (not masked) to the log output. I would expect that this password is masked using the 'Default' Jenkins mechanism but it is not.
As a easy test I've changed the goal to be executed as "Release goals and options" to "help:system". If I now start a release build and enter scm username/password. I can read in the Log:<===[JENKINS REMOTING CAPACITY]===>channel started
Executing Maven: -B -f /export/sbs/jenkins/home/ workspace/am-test/pom.xml -DdevelopmentVersion=2- SNAPSHOT -DreleaseVersion=1 -Dusername=jenkins help:system -Dpassword=*********[INFO] Scanning for projects...
[INFO] --- maven-help-plugin:2.2:system (default-cli) @ my-module --- ...
============================== ============================== =================== System Properties ============================== ============================== =================== JOB_NAME=am-test ...
password=mysecretpassword
...
Bug or usage error? Any hint would be appreciated.
Kind Regards,
Andreas.
You received this message because you are subscribed to the Google Groups "Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/69e3b66d-dd12-42de-b3dc-850f43c59a1f%40googlegroups.com.
Andreas
Mar 30, 2015, 5:17:11 PM3/30/15
to jenkins...@googlegroups.com, eric...@rocketmail.com
Eric, thanks for the hint.
Nevertheless, the masking just works if I also expose the password as "SCM password environment variable", for both EnvInject and Mask Password plugin.
Kind Regards, Andreas.
Nevertheless, the masking just works if I also expose the password as "SCM password environment variable", for both EnvInject and Mask Password plugin.
Kind Regards, Andreas.
James Nord
Apr 9, 2015, 6:41:47 AM4/9/15
to jenkins...@googlegroups.com, eric...@rocketmail.com
Can you file an RFE on the issue tracker for the m2release plugin.
You shouldn't need to jump through hoops for this to work.
Andreas
Apr 9, 2015, 12:38:54 PM4/9/15
to jenkins...@googlegroups.com, eric...@rocketmail.com
I did so: JENKINS-27869.
Reply all
Reply to author
Forward
0 new messages