Repository navigation
[JENKINS-911] Alternate Launcher.launch that hides passwords on command line #866
Description
The current implementations of Launcher.launch(...)
all print the command line verbatim to the log.
When the command line includes a password, this is not good.
A second Launcher.launch(...) method which would allow the caller to **** out
the info that goes to the log files to make password snooping more difficult
Originally reported by 
stephenconnolly, imported from: Alternate Launcher.launch that hides passwords on command line
- status: Closed
- priority: Major
- component(s): remoting
- resolution: Fixed
- resolved: 2007-10-16T02:03:29+00:00
- votes: 0
- watchers: 0
- imported: 2025-11-25
Raw content of original issue
The current implementations of Launcher.launch(...)
all print the command line verbatim to the log.
When the command line includes a password, this is not good.
A second Launcher.launch(...) method which would allow the caller to **** out the info that goes to the log files to make password snooping more difficult
- environment:
Platform: All, OS: All
Activity
jenkins-infra-bot commentedon Oct 15, 2007
Raw content of original comment:
It's a reasonable request but using passwords on command line arguments is
really insecure anyway — you still get to see them through /proc, pargs,
process explorer, etc.
jenkins-infra-bot commentedon Oct 15, 2007
Raw content of original comment:
Oh I know, but it's better than nothing for those cases where you have to pass
the password over the command line
jenkins-infra-bot commentedon Oct 15, 2007
Raw content of original comment:
/proc etc. are visible only to people logged in on the same machine (with
appropriate permissions). Quite different from a build log exposed via the web.
jenkins-infra-bot commentedon Oct 15, 2007
Raw content of original comment:
Anyway, agreed that this is a better than nothing feature.
jenkins-infra-bot commentedon Oct 16, 2007
Raw content of original comment:
I have added one approach for the necessary methods to Launcher.launch, added
javadoc warning that these methods only help with the build log, and updated the
change log to reflect this.
Target 1.147
jenkins-infra-bot commentedon Oct 23, 2007
Raw content of original comment:
closing this issue