SECURITY-1429 Do not show authKey and urlPassword as plaintext in con…

…fig.xml
jenkinsci · Jul 24, 2019 · 167986a · 167986a
1 parent 4835d48
commit 167986a
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 18 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/skytap/CreatePublishURLStep.java b/src/main/java/org/jenkinsci/plugins/skytap/CreatePublishURLStep.java
@@ -36,6 +36,7 @@
 import hudson.Extension;
 import hudson.model.AbstractBuild;
 import hudson.FilePath;
+import hudson.util.Secret;
 
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.methods.HttpPost;
@@ -60,7 +61,7 @@ public class CreatePublishURLStep extends SkytapAction {
 	private final String permissionOption;
 
 	private final Boolean hasPassword;
-	private final String urlPassword;
+	private final Secret urlPassword;
 
 	// these will be initialized when the step is run
 	@XStreamOmitField
@@ -315,10 +316,10 @@ private List<String> getVMIds(String confId) throws SkytapException {
 
 	// "requirePassword":{"urlPassword":"qsdqweq"}
 	public static class RequirePasswordBlock {
-		private String password;
+		private Secret password;
 
 		@DataBoundConstructor
-		public RequirePasswordBlock(String urlPassword) {
+		public RequirePasswordBlock(Secret urlPassword) {
 			this.password = urlPassword;
 		}
 	}
@@ -385,7 +386,7 @@ public Boolean getHasPassword() {
 	}
 
 	public String getUrlPassword() {
-		return urlPassword;
+		return Secret.toString(urlPassword);
 	}
 
 	public String getPortalName() {

diff --git a/src/main/java/org/jenkinsci/plugins/skytap/SkytapBuildWrapper.java b/src/main/java/org/jenkinsci/plugins/skytap/SkytapBuildWrapper.java
@@ -18,7 +18,7 @@
 // LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 // OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 // THE SOFTWARE.
-//                        
+//
 package org.jenkinsci.plugins.skytap;
 
 import hudson.EnvVars;
@@ -29,6 +29,7 @@
 import hudson.model.AbstractProject;
 import hudson.tasks.BuildWrapper;
 import hudson.tasks.BuildWrapperDescriptor;
+import hudson.util.Secret;
 
 import java.io.IOException;
 import java.util.Map;
@@ -39,11 +40,11 @@ public class SkytapBuildWrapper extends BuildWrapper {
 
 	@Extension
 	public static class DescriptorImpl extends BuildWrapperDescriptor {
-	
+
 		public DescriptorImpl() {
 			load();
 		}
-		
+
 		@Override
 		public String getDisplayName() {
 			return "Skytap Cloud Authentication Credentials";
@@ -57,49 +58,49 @@ public boolean isApplicable(final AbstractProject<?, ?> item) {
 	}
 
 	private final String userId;
-	private final String authKey;
+	private final Secret authKey;
 
 	@DataBoundConstructor
-	public SkytapBuildWrapper(final String userId, final String authKey) {
+	public SkytapBuildWrapper(final String userId, final Secret authKey) {
 		super();
 		this.userId = userId;
 		this.authKey = authKey;
 	}
-	
+
 	public String getUserId() {
 		return userId;
 	}
 
 	public String getAuthKey() {
-		return authKey;
+		return Secret.toString(authKey);
 	}
-	
+
 	@Override
 	  public BuildWrapper.Environment setUp(
 	      @SuppressWarnings("rawtypes") final AbstractBuild build,
 	      final Launcher launcher, final BuildListener listener)
 	      throws IOException, InterruptedException
 	  {
-	   
+
 	       EnvVars env = build.getEnvironment(listener);
 	       env.put("userId", userId);
-	       env.put("authKey", authKey);
-	       
+	       env.put("authKey", Secret.toString(authKey));
+
 	    return new Environment()
 	    {
 	      /* empty implementation */
 	    };
 	  }
-	
+
 	@Override
 	public void makeBuildVariables(AbstractBuild build,
 			Map<String, String> variables) {
 
 		variables.put("userId", userId);
-		variables.put("authKey", authKey);
+		variables.put("authKey", Secret.toString(authKey));
 
 	}
-	
+
     @Override
     public DescriptorImpl getDescriptor() {
         return (DescriptorImpl)super.getDescriptor();