[JIRA] (JENKINS-58540) Console output of pipeline extra stars

41 views
Skip to first unread message

erwin.mueller@nttdata.com (JIRA)

unread,
Jul 18, 2019, 3:02:02 AM7/18/19
to jenkinsc...@googlegroups.com
Erwin Müller created an issue
 
Jenkins / Bug JENKINS-58540
Console output of pipeline extra stars
Issue Type: Bug Bug
Assignee: Unassigned
Components: core
Created: 2019-07-18 07:01
Environment: Kubernetes 1.13.
Jenkins ver. 2.176.2
  installPlugins:
    - kubernetes:1.17.2
    - workflow-job:2.32
    - workflow-aggregator:2.6
    - credentials-binding:1.19
    - git:3.10.1
    - oic-auth:1.6
    - matrix-auth:2.4.2
    - sonar:2.9
    - config-file-provider:3.6.2
    - gitea:1.1.2
    - pipeline-maven:3.8.0
    - junit-attachments:1.5
    - jacoco:3.0.4
    - warnings-ng:5.3.0
    - pipeline-utility-steps:2.3.0
    - groovy-postbuild:2.5
    - embeddable-build-status:2.0.2
Labels: consoleoutput
Priority: Major Major
Reporter: Erwin Müller

Since yesterday my console logs have extra * stars at each character. Even if I have a really simple pipeline like

 

pipeline {    options {
        buildDiscarder(logRotator(numToKeepStr: "3"))
        disableConcurrentBuilds()
        timeout(time: 120, unit: "MINUTES")
    }    agent {
        label "maven-3-jdk-12"
    }    stages {        /**
        * The stage will checkout the current branch.
        */
        stage("Checkout Build") {
            steps {
                checkout scm
            }
        }    } // stages}

The weird thing is that those * stars are only added if I use the maven-3-jdk-12 agent. I tried it with a docker and kubernetes agent and I do not get all those stars in my log.

 

 

 

Started by user Erwin Müller
Querying the current revision of branch jenkins...
Current revision of branch jenkins is 2a5e780086a6d95801378dd62c6107e3367d2b0f
Obtained Jenkinsfile from 2a5e780086a6d95801378dd62c6107e3367d2b0f
Running in Durability level: MAX_SURVIVABILITY
[Pipeline] Start of Pipeline
[Pipeline] node
Still waiting to schedule task
Waiting for next available executor on ‘maven-3-jdk-12-1566w’
Agent maven-3-jdk-12-x49g2 is provisioned from template Kubernetes Pod Template
Agent specification [Kubernetes Pod Template] (maven-3-jdk-12): 
* [jnlp] jenkins/jnlp-slave:3.29-1-alpine
* [maven] erwin82/maven:v3.6.1-jdk-12-r.10(resourceRequestCpu: 0, resourceRequestMemory: 0, resourceLimitCpu: 2.0, resourceLimitMemory: 2Gi)
yaml:
apiVersion: v1
kind: Pod
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
        - matchExpressions:
          - key: agent.jenkins.anrisoftware.com
            operator: In
            values:
            - required
Running on maven-3-jdk-12-x49g2 in /home/jenkins/workspace/al-rest-analysis-service_jenkins
[Pipeline] {
[Pipeline] stage
[Pipeline] { (Declarative: Checkout SCM)
[Pipeline] checkout
********u********s********i********n********g******** ********c********r********e********d********e********n********t********i********a********l******** ********j********e********n********k********i********n********s********-********g********i********t********e********a********

It can not be this issue https://issues.jenkins-ci.org/browse/JENKINS-41760 because in the example pipeline I am not using any credentials. Also, this issue is only if I use the maven docker image but not in any other image.

For example with the docker agent:

Started by user Erwin Müller
Querying the current revision of branch jenkins...
Current revision of branch jenkins is 360c219162eae6026a231ff6c49103666770355a
Obtained Jenkinsfile from 360c219162eae6026a231ff6c49103666770355a
Running in Durability level: MAX_SURVIVABILITY
[Pipeline] Start of Pipeline
[Pipeline] node
Agent docker-18-dwxpr is provisioned from template Kubernetes Pod Template
Agent specification [Kubernetes Pod Template] (docker): 
* [jnlp] jenkins/jnlp-slave:3.29-1-alpine
* [docker] docker:18.09.7-git(resourceRequestCpu: 0, resourceRequestMemory: 0, resourceLimitCpu: 1.0, resourceLimitMemory: 1Gi)
* [dind] docker:18.09.7-dind(resourceRequestCpu: 0, resourceRequestMemory: 0, resourceLimitCpu: 1.0, resourceLimitMemory: 1Gi)Running on docker-18-dwxpr in /home/jenkins/workspace/al-rest-analysis-service_jenkins
[Pipeline] {
[Pipeline] stage
[Pipeline] { (Declarative: Checkout SCM)
[Pipeline] checkout
using credential jenkins-gitea
Fetching changes from the remote Git repository
Fetching without tags
Checking out Revision 360c219162eae6026a231ff6c49103666770355a (jenkins)
 > git rev-parse --is-inside-work-tree # timeout=10
 > git config remote.origin.url https://gitea.anrisoftware.com/anrisoftware.com/timefractal-rest-analysis-service.git # timeout=10
Fetching upstream changes from https://gitea.anrisoftware.com/anrisoftware.com/timefractal-rest-analysis-service.git
 > git --version # timeout=10
using GIT_ASKPASS to set credentials 
 > git fetch --no-tags --force --progress https://gitea.anrisoftware.com/anrisoftware.com/timefractal-rest-analysis-service.git +refs/heads/jenkins:refs/remotes/origin/jenkins
 > git config core.sparsecheckout # timeout=10
 > git checkout -f 360c219162eae6026a231ff6c49103666770355a
Commit message: "Use docker."
 > git rev-list --no-walk 2a5e780086a6d95801378dd62c6107e3367d2b0f # timeout=10
[Gitea] Notifying branch build status: PENDING Build started...
[Gitea] Notified
[Pipeline] }
[Pipeline] // stage
[Pipeline] withEnv
[Pipeline] {
[Pipeline] timeout
Timeout set to expire in 2 hr 0 min
[Pipeline] {
[Pipeline] stage
[Pipeline] { (Checkout Build)
[Pipeline] checkout
using credential jenkins-gitea
Fetching changes from the remote Git repository
Fetching without tags
Checking out Revision 360c219162eae6026a231ff6c49103666770355a (jenkins)
Commit message: "Use docker."
[Gitea] Notifying branch build status: PENDING Build started...
 > git rev-parse --is-inside-work-tree # timeout=10
 > git config remote.origin.url https://gitea.anrisoftware.com/anrisoftware.com/timefractal-rest-analysis-service.git # timeout=10
Fetching upstream changes from https://gitea.anrisoftware.com/anrisoftware.com/timefractal-rest-analysis-service.git
 > git --version # timeout=10
using GIT_ASKPASS to set credentials 
 > git fetch --no-tags --force --progress https://gitea.anrisoftware.com/anrisoftware.com/timefractal-rest-analysis-service.git +refs/heads/jenkins:refs/remotes/origin/jenkins
 > git config core.sparsecheckout # timeout=10
 > git checkout -f 360c219162eae6026a231ff6c49103666770355a
[Gitea] Notified
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // timeout
[Pipeline] }
[Pipeline] // withEnv
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
[Gitea] Notifying branch build status: SUCCESS This commit looks good
[Gitea] Notified
Finished: SUCCESS

 

Add Comment Add Comment
 
This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

dbeck@cloudbees.com (JIRA)

unread,
Jul 19, 2019, 4:17:02 AM7/19/19
to jenkinsc...@googlegroups.com
Daniel Beck commented on Bug JENKINS-58540
 
Re: Console output of pipeline extra stars

Matt Sicker Could this happen when a secret being masked is empty?

erwin.mueller@nttdata.com (JIRA)

unread,
Jul 19, 2019, 4:53:02 AM7/19/19
to jenkinsc...@googlegroups.com

This worked before perfectly fine.

All my secrets are set and the pipeline is green.

Why is that happening only if I select a maven agent? I already tried to rename the agent in something like "aaa" and it's still happening.

The extra * are added even if the pipeline is not using any secrets.

The bug with the credential-binding plugin was solved in 2017. Maybe it's a regression.

boards@gmail.com (JIRA)

unread,
Jul 19, 2019, 11:05:02 AM7/19/19
to jenkinsc...@googlegroups.com

That looks like it's replacing empty spaces by asterisks, so yeah, it does appear that way.

dbeck@cloudbees.com (JIRA)

unread,
Jul 19, 2019, 11:48:02 AM7/19/19
to jenkinsc...@googlegroups.com
Daniel Beck updated an issue
 
Change By: Daniel Beck
Component/s: credentials-binding-plugin
Component/s: core

swojas@zendesk.com (JIRA)

unread,
Jul 25, 2019, 9:21:01 AM7/25/19
to jenkinsc...@googlegroups.com
Sebastian Wojas commented on Bug JENKINS-58540
 
Re: Console output of pipeline extra stars

Any updates here ? we have exactly the same problem on our end.

karolgil.kg@gmail.com (JIRA)

unread,
Jul 26, 2019, 7:52:04 AM7/26/19
to jenkinsc...@googlegroups.com

I think the problem lies in `SecretsMasker` class.
Here, it tries to replace every value kept in `values` set with bunch of asterisks: https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/pipeline/SecretsMasker.java#L74

But what is not takes into account I assume, is that some of strings kept in `values` field may be empty string "" causing this line be like:
```
s = s.replace("", "********");
```
which actually gives away the secret value

karolgil.kg@gmail.com (JIRA)

unread,
Jul 26, 2019, 7:53:02 AM7/26/19
to jenkinsc...@googlegroups.com
Karol Gil edited a comment on Bug JENKINS-58540
I think the problem lies in `SecretsMasker` class.
Here, it tries to replace every value kept in `values` set with bunch of asterisks:
[ https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/pipeline/SecretsMasker.java#L74 ]

But what is not takes into account I assume, is that some of strings kept in `values` field may be empty string "" causing this line be like:
```
 



   
s = s.replace("", "********");
```
 


which actually gives away the secret value :)

karolgil.kg@gmail.com (JIRA)

unread,
Jul 26, 2019, 7:53:03 AM7/26/19
to jenkinsc...@googlegroups.com

karolgil.kg@gmail.com (JIRA)

unread,
Jul 26, 2019, 7:53:03 AM7/26/19
to jenkinsc...@googlegroups.com

karolgil.kg@gmail.com (JIRA)

unread,
Jul 26, 2019, 7:55:02 AM7/26/19
to jenkinsc...@googlegroups.com
Karol Gil edited a comment on Bug JENKINS-58540
I think the problem lies in `SecretsMasker` class.
Here, it tries to replace every value kept in `values` set with bunch of asterisks: [https://github.com/jenkinsci/kubernetes-plugin/blob/master/src/main/java/org/csanchez/jenkins/plugins/kubernetes/pipeline/SecretsMasker.java#L74]

But what is not takes into account I assume, is that some of strings kept in `values` field may be empty string "" causing this line be like:

{{    s = s.replace("", "********");}}

which actually gives away the secret value :)


I'm not sure how to implement it properly, but this assumes that secrets are not obvious strings that will be replaced.

dbeck@cloudbees.com (JIRA)

unread,
Jul 26, 2019, 8:56:02 AM7/26/19
to jenkinsc...@googlegroups.com

Karol Gil Agree, that was also my guess in the first comment.

Would consider no value shorter than two characters maskable.

karolgil.kg@gmail.com (JIRA)

unread,
Jul 26, 2019, 9:25:02 AM7/26/19
to jenkinsc...@googlegroups.com

I think it still might not be enough. The problem is IMO that your secret may be common for example `kubernetes` and then making it into `*******` can easily give away your secret anyway - as you'll find many like that in the logs. But this is fixable on end user side of things, so I agree, having even length > 0 would be great or even better - to be configurable.

dbeck@cloudbees.com (JIRA)

unread,
Jul 26, 2019, 9:43:02 AM7/26/19
to jenkinsc...@googlegroups.com

A single character is also too short to be useful in masking. 2 should be the minimum for masking (and it needs to be documented).

Would recommend against an option, the vast majority won't care or even understand it, and it'll just clutter up the UI.

karolgil.kg@gmail.com (JIRA)

unread,
Jul 26, 2019, 10:40:03 AM7/26/19
to jenkinsc...@googlegroups.com

I meant using system properties - won't clutter the UI but will still be an option.

karolgil.kg@gmail.com (JIRA)

unread,
Jul 29, 2019, 7:08:02 AM7/29/19
to jenkinsc...@googlegroups.com

I've added a PR with fix proposal, feel free to comment/feedback there: https://github.com/jenkinsci/kubernetes-plugin/pull/558

vincent@latombe.net (JIRA)

unread,
Jul 29, 2019, 7:13:04 AM7/29/19
to jenkinsc...@googlegroups.com
Vincent Latombe updated an issue
 
Change By: Vincent Latombe
Component/s: kubernetes-plugin

jglick@cloudbees.com (JIRA)

unread,
Jul 29, 2019, 8:59:02 AM7/29/19
to jenkinsc...@googlegroups.com
Jesse Glick assigned an issue to Karol Gil
Change By: Jesse Glick
Assignee: Karol Gil

jglick@cloudbees.com (JIRA)

unread,
Jul 29, 2019, 8:59:03 AM7/29/19
to jenkinsc...@googlegroups.com

jglick@cloudbees.com (JIRA)

unread,
Jul 29, 2019, 8:59:03 AM7/29/19
to jenkinsc...@googlegroups.com
Jesse Glick started work on Bug JENKINS-58540
 
Change By: Jesse Glick
Status: Open In Progress

jglick@cloudbees.com (JIRA)

unread,
Jul 29, 2019, 9:01:04 AM7/29/19
to jenkinsc...@googlegroups.com

jglick@cloudbees.com (JIRA)

unread,
Jul 29, 2019, 9:03:03 AM7/29/19
to jenkinsc...@googlegroups.com

As a matter of curiosity, how did you wind up with an empty secret to begin with?

karolgil.kg@gmail.com (JIRA)

unread,
Jul 29, 2019, 9:13:02 AM7/29/19
to jenkinsc...@googlegroups.com

Jesse Glick we have a set of secrets assigned to pods depending on the environment which they are testing. If given service does not exist on certain environment secret for it is empty.

Reply all
Reply to author
Forward
0 new messages