Skip to content
Permalink
Browse files Browse the repository at this point in the history
[FIXED SECURITY-93] PasswordParameterDefinition should serve existing…
… default value in encrypted form.

And strengthen functional tests (using configRoundTrip) to ensure that the same mistake is not made elsewhere.
  • Loading branch information
jglick committed Feb 11, 2014
1 parent 5548b52 commit bf53919
Show file tree
Hide file tree
Showing 4 changed files with 54 additions and 1 deletion.
3 changes: 3 additions & 0 deletions core/src/main/java/hudson/Functions.java
Expand Up @@ -1464,6 +1464,9 @@ public List<String> getLoggerNames() {
public String getPasswordValue(Object o) {
if (o==null) return null;
if (o instanceof Secret) return ((Secret)o).getEncryptedValue();
if (getIsUnitTest()) {
throw new SecurityException("attempted to render plaintext ‘" + o + "’ in password field; use a getter of type Secret instead");
}
return o.toString();
}

Expand Down
Expand Up @@ -28,6 +28,8 @@
import org.kohsuke.stapler.DataBoundConstructor;
import hudson.Extension;
import hudson.util.Secret;
import org.kohsuke.accmod.Restricted;
import org.kohsuke.accmod.restrictions.DoNotUse;

/**
* Parameter whose value is a {@link Secret} and is hidden from the UI.
Expand Down Expand Up @@ -76,6 +78,11 @@ public String getDefaultValue() {
return Secret.toString(defaultValue);
}

@Restricted(DoNotUse.class) // used from Jelly
public Secret getDefaultValueAsSecret() {
return defaultValue;
}

// kept for backward compatibility
public void setDefaultValue(String defaultValue) {
this.defaultValue = Secret.fromString(defaultValue);
Expand Down
Expand Up @@ -30,7 +30,7 @@ THE SOFTWARE.
<f:textbox name="parameter.name" value="${instance.name}" />
</f:entry>
<f:entry title="${%Default Value}" help="/help/parameter/string-default.html">
<f:password name="parameter.defaultValue" value="${instance.defaultValue}" />
<f:password name="parameter.defaultValue" value="${instance.defaultValueAsSecret}" />
</f:entry>
<f:entry title="${%Description}" help="/help/parameter/description.html">
<f:textarea name="parameter.description" value="${instance.description}" />
Expand Down
@@ -0,0 +1,43 @@
/*
* The MIT License
*
* Copyright 2013 Jesse Glick.
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
* in the Software without restriction, including without limitation the rights
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
* copies of the Software, and to permit persons to whom the Software is
* furnished to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in
* all copies or substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
* THE SOFTWARE.
*/

package hudson.model;

import static org.junit.Assert.assertEquals;
import org.junit.Rule;
import org.junit.Test;
import org.jvnet.hudson.test.JenkinsRule;

public class PasswordParameterDefinitionTest {

@Rule public JenkinsRule j = new JenkinsRule();

@Test public void defaultValueKeptSecret() throws Exception {
FreeStyleProject p = j.createFreeStyleProject();
p.addProperty(new ParametersDefinitionProperty(new PasswordParameterDefinition("p", "s3cr3t", "")));
j.configRoundtrip(p);
assertEquals("s3cr3t", ((PasswordParameterDefinition) p.getProperty(ParametersDefinitionProperty.class).getParameterDefinition("p")).getDefaultValue());
}

}

0 comments on commit bf53919

Please sign in to comment.