Add base64 masking

[Kevin-CB]

There is no support for base64-encoded credentials, and it's not an encryption method and it can be easily decoded.

To prevent base64-encoded credentials from being exposed in build logs, I added a new SecretPatternFactory for it.

Testing done

I wrote a test to ensure it was done properly on Windows and Unix-based systems but I also tested it locally with the following pipeline:

node {
    withCredentials([usernamePassword(credentialsId: "CredID1", usernameVariable: 'USERNAME', passwordVariable: 'PASSWORD')]) {
        sh '''
            echo Base64 encoded password:
            echo -n $PASSWORD | base64
            echo "========================================"
            curl -v https://$USERNAME:$PASSWORD@google.com
            echo "========================================"
        '''
    }
}

Before:

After:

Submitter checklist

Edit tasklist title

Beta Give feedback Tasklist Submitter checklist, more options

• Rename
• Copy markdown
• Delete tasklist

Delete tasklist

Delete tasklist block?

Are you sure? All relationships in this tasklist will be removed.

Cancel Delete

1. Make sure you are opening from a **topic/feature/bugfix branch** (right side) and not your main branch!

   Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove
2. Ensure that the pull request title represents the desired changelog entry

   Ensure that the pull request title represents the desired changelog entry
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove
3. Please describe what you did

   Please describe what you did
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove
4. Link to relevant issues in GitHub or Jira

   Link to relevant issues in GitHub or Jira
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove
5. Link to relevant pull requests, esp. upstream and downstream changes

   Link to relevant pull requests, esp. upstream and downstream changes
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove
6. Ensure you have provided tests - that demonstrates feature works or fixes the issue

   Ensure you have provided tests - that demonstrates feature works or fixes the issue
   Options

   • Convert to issue
   • Toggle completion
   • Rename
   • Remove

Add item to Submitter checklist Loading

[yaroslavafenkin]

Seems to work well in local testing

[yaroslavafenkin]

Perhaps use Set over List?

[jglick]

Should not matter I think; all the patterns will wind up merged into one big pattern sorted by length.

[jglick]

credentials-binding-plugin/src/main/java/org/jenkinsci/plugins/credentialsbinding/masking/SecretPatterns.java

Lines 61 to 65 in b19cfc6

	.flatMap(input ->
	secretPatternFactories.stream().flatMap(factory ->
	factory.getEncodedForms(input).stream()))
	.sorted(BY_LENGTH_DESCENDING)
	.distinct()

[jglick]

Ready to go I think; @daniel-beck or @Wadeck or anyone else want to take a look?

[Wadeck]

Not manually tested this version, but looks very similar to what I expected 👍

[jglick]

Check jenkinsci/config-file-provider-plugin#296.