| Password parameter types are sent in clear text to Logstash together with the other build variables (data.buildVariables.) when using Logstash wrapper in pipeline. I don't know if this ever worked for pipeline. I do know that we have a working password masking in the Jenkins build log using MaskPasswordsBuildWrapper. Problem is very easy to reproduce. Here is a minimal (scripted) parametrized pipeline that shows the problem. It has a "Password Parameter" (hudson.model.PasswordParameterDefinition) named SECRET defined in job.
node('java8') {
wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[var: 'SECRET', password: SECRET]]]) {
logstash {
echo "SECRET NOT masked in message: ${SECRET}"
}
}
logstash {
wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[var: 'SECRET', password: SECRET]]]) {
echo "SECRET masked in message: ${SECRET}"
}
}
}
It seems that the message is masked, given that you put the MaskPasswordsBuildWrapper inside the logstash wrapper, but this does change the fact that the secret is in data.buildVariables.SECRET in Logstash. Same for declarative pipeline Pipeline config
pipeline {
agent { label 'java8' }
parameters {
string(name: 'NOT_SECRET', defaultValue: 'Not secret!')
password(name: 'SECRET', defaultValue: '')
}
stages {
stage('Log') {
steps {
wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[var: 'SECRET', password: SECRET]]]) {
logstash {
echo "Secret masked in log but NOT in message: '${SECRET}' , Not Secret: '${NOT_SECRET}'"
}
}
logstash {
wrap([$class: 'MaskPasswordsBuildWrapper', varPasswordPairs: [[var: 'SECRET', password: SECRET]]]) {
echo "Secret masked in log AND message: '${SECRET}' , Not Secret: '${NOT_SECRET}'"
}
}
}
}
}
}
Jenkins build logs
[Pipeline] node
Running on std-platform-jenkins-agent-03.nix.cydmodule.com in /var/opt/jenkins-slave/workspace/Experiments/test-logstash-password-masking
[Pipeline] {
[Pipeline] stage
[Pipeline] { (Log)
[Pipeline] wrap
[Pipeline] {
[Pipeline] logstash
[Pipeline] {
[Pipeline] echo
Secret masked in log but NOT in message: '********' , Not Secret: 'Not secret!'
[Pipeline] }
[Pipeline] // logstash
[Pipeline] }
[Pipeline] // wrap
[Pipeline] logstash
[Pipeline] {
[Pipeline] wrap
[Pipeline] {
[Pipeline] echo
Secret masked in log AND message: '********' , Not Secret: 'Not secret!'
[Pipeline] }
[Pipeline] // wrap
[Pipeline] }
[Pipeline] // logstash
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
Finished: SUCCESS
Kibana See attachment |
