[JIRA] (JENKINS-54538) Ability to save unmasked credentials to file

[tfijarczyk@gmail.com (JIRA)]

Tomasz Fijarczyk created an issue

Jenkins / JENKINS-54538 Ability to save unmasked credentials to file Issue Type: Bug Assignee: Unassigned Components: credentials-binding-plugin Created: 2018-11-08 11:06 Environment: Jenkins 2.149 - Credential Binding 1.17 Priority: Major Reporter: Tomasz Fijarczyk It looks like saving password variable from withCredentials using writeFile doesn't mask the password. I consider this to be a security vulnerability. Add Comment

This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

[Kalle.Niemitalo@procomp.fi (JIRA)]

Kalle Niemitalo commented on JENKINS-54538

Re: Ability to save unmasked credentials to file https://jenkins.io/doc/pipeline/steps/credentials-binding/ says this is by design: "The masking could of course be trivially circumvented; anyone permitted to configure a job or define Pipeline steps is assumed to be trusted to use any credentials in scope however they like."

Add Comment

This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)

[tfijarczyk@gmail.com (JIRA)]

Tomasz Fijarczyk commented on JENKINS-54538

Re: Ability to save unmasked credentials to file

Make sens, can't believe I missed the obvious

Add Comment

[tfijarczyk@gmail.com (JIRA)]

Tomasz Fijarczyk closed an issue as Not A Defect

Jenkins / JENKINS-54538

Ability to save unmasked credentials to file

Change By: Tomasz Fijarczyk Status: Open Closed Resolution: Not A Defect

Add Comment