Skip to content

Commit e8237a8

Browse files
tomasbjerretomasbjerre
committed
Removing raw API Token and forcing credential
In a pipeline you can no longer do `apiToken: 'asd'` and will have to do `apiTokenCredentialsId: 'id'`. SECURITY-1577
1 parent fbf1796 commit e8237a8

File tree

9 files changed

+35
-89
lines changed

9 files changed

+35
-89
lines changed

‎README.md‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,6 @@ job('GitLab_MR_Builder') {
292292
enableLogging(true)
293293
294294
295-
apiToken("")
296295
apiTokenCredentialsId("gitlabtoken")
297296
apiTokenPrivate(true)
298297
authMethodHeader(true)
@@ -485,8 +484,6 @@ node {
485484
proxyUser: '',
486485
proxyPassword: '',
487486
488-
// Specify one of these
489-
apiToken: '6xRcmSzPzzEXeS2qqr7R',
490487
apiTokenCredentialsId: 'id',
491488
492489
apiTokenPrivate: true,

‎pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@
1313
<jenkins.version>2.1</jenkins.version>
1414
<findbugs.failOnError>false</findbugs.failOnError>
1515
<maven.javadoc.skip>true</maven.javadoc.skip>
16-
<violations-maven>1.20</violations-maven>
16+
<violations-maven>1.21</violations-maven>
1717
<violation-comments-lib>1.78</violation-comments-lib>
18-
<violations-lib>1.97</violations-lib>
18+
<violations-lib>1.101</violations-lib>
1919
<changelog>1.60</changelog>
2020
<fmt>2.9</fmt>
2121
</properties>

‎sandbox/gitlab.com.testpipeline.jenkinsfile‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,9 +26,6 @@ node {
2626
commentOnlyChangedFiles: true,
2727
createCommentWithAllSingleFileComments: true,
2828
minSeverity: 'INFO',
29-
useApiToken: true,
30-
apiToken: 'asdasdasdasd',
31-
useApiTokenCredentials: false,
3229
apiTokenCredentialsId: 'id',
3330
apiTokenPrivate: true,
3431
authMethodHeader: true,

‎src/main/java/org/jenkinsci/plugins/jvctgl/ViolationsToGitLabGlobalConfiguration.java‎

Lines changed: 10 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ public static ViolationsToGitLabGlobalConfiguration get() {
3535

3636
private boolean ignoreCertificateErrors;
3737

38-
private String apiToken;
3938
private boolean apiTokenPrivate;
4039
private boolean authMethodHeader;
4140
private String apiTokenCredentialsId;
@@ -63,16 +62,18 @@ public ListBoxModel doFillMinSeverityItems() {
6362

6463
@SuppressWarnings("unused") // Used by stapler
6564
public ListBoxModel doFillApiTokenCredentialsIdItems(
66-
@AncestorInPath Item item,
67-
@QueryParameter String apiTokenCredentialsId,
68-
@QueryParameter String gitLabUrl) {
65+
@AncestorInPath final Item item,
66+
@QueryParameter final String apiTokenCredentialsId,
67+
@QueryParameter final String gitLabUrl) {
6968
return CredentialsHelper.doFillApiTokenCredentialsIdItems(
7069
item, apiTokenCredentialsId, gitLabUrl);
7170
}
7271

7372
@SuppressWarnings("unused") // Used by stapler
7473
public FormValidation doCheckApiTokenCredentialsId(
75-
@AncestorInPath Item item, @QueryParameter String value, @QueryParameter String gitLabUrl) {
74+
@AncestorInPath final Item item,
75+
@QueryParameter final String value,
76+
@QueryParameter final String gitLabUrl) {
7677
return CredentialsHelper.doCheckApiTokenCredentialsId(item, value, gitLabUrl);
7778
}
7879

@@ -89,13 +90,11 @@ public void setIgnoreCertificateErrors(final boolean ignoreCertificateErrors) {
8990
this.ignoreCertificateErrors = ignoreCertificateErrors;
9091
}
9192

92-
public String getApiToken() {
93-
return apiToken;
94-
}
95-
9693
@DataBoundSetter
94+
@Deprecated
9795
public void setApiToken(final String apiToken) {
98-
this.apiToken = apiToken;
96+
throw new RuntimeException(
97+
"Setting raw API token is removed, set the apiTokenCredentialsId with a string credential instead!");
9998
}
10099

101100
public String getApiTokenCredentialsId() {
@@ -147,7 +146,6 @@ public void setAuthMethodHeader(final boolean authMethodHeader) {
147146
public int hashCode() {
148147
final int prime = 31;
149148
int result = 1;
150-
result = prime * result + (apiToken == null ? 0 : apiToken.hashCode());
151149
result =
152150
prime * result + (apiTokenCredentialsId == null ? 0 : apiTokenCredentialsId.hashCode());
153151
result = prime * result + (apiTokenPrivate ? 1231 : 1237);
@@ -159,7 +157,7 @@ public int hashCode() {
159157
}
160158

161159
@Override
162-
public boolean equals(Object obj) {
160+
public boolean equals(final Object obj) {
163161
if (this == obj) {
164162
return true;
165163
}
@@ -170,13 +168,6 @@ public boolean equals(Object obj) {
170168
return false;
171169
}
172170
final ViolationsToGitLabGlobalConfiguration other = (ViolationsToGitLabGlobalConfiguration) obj;
173-
if (apiToken == null) {
174-
if (other.apiToken != null) {
175-
return false;
176-
}
177-
} else if (!apiToken.equals(other.apiToken)) {
178-
return false;
179-
}
180171
if (apiTokenCredentialsId == null) {
181172
if (other.apiTokenCredentialsId != null) {
182173
return false;
@@ -212,8 +203,6 @@ public String toString() {
212203
+ gitLabUrl
213204
+ ", ignoreCertificateErrors="
214205
+ ignoreCertificateErrors
215-
+ ", apiToken="
216-
+ apiToken
217206
+ ", apiTokenPrivate="
218207
+ apiTokenPrivate
219208
+ ", authMethodHeader="

‎src/main/java/org/jenkinsci/plugins/jvctgl/config/ViolationsToGitLabConfig.java‎

Lines changed: 12 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ public class ViolationsToGitLabConfig extends AbstractDescribableImpl<Violations
3333
private boolean createSingleFileComments;
3434
private List<ViolationConfig> violationConfigs;
3535
private String gitLabUrl;
36-
private String apiToken;
3736
private String projectId;
3837
private String mergeRequestIid;
3938
@Deprecated private transient String mergeRequestId;
@@ -53,14 +52,18 @@ public class ViolationsToGitLabConfig extends AbstractDescribableImpl<Violations
5352

5453
@DataBoundConstructor
5554
public ViolationsToGitLabConfig(
56-
final String gitLabUrl, final String projectId, final String mergeRequestIid) {
55+
final String gitLabUrl,
56+
final String projectId,
57+
final String mergeRequestIid,
58+
final String apiTokenCredentialsId) {
5759
this.gitLabUrl = gitLabUrl;
5860
this.projectId = projectId;
5961
this.mergeRequestIid = mergeRequestIid;
6062
this.keepOldComments = true;
6163
this.shouldSetWip = false;
6264
this.enableLogging = false;
6365
this.maxNumberOfViolations = null;
66+
this.apiTokenCredentialsId = apiTokenCredentialsId;
6467
}
6568

6669
public ViolationsToGitLabConfig(final ViolationsToGitLabConfig rhs) {
@@ -70,7 +73,6 @@ public ViolationsToGitLabConfig(final ViolationsToGitLabConfig rhs) {
7073
this.commentOnlyChangedContent = rhs.commentOnlyChangedContent;
7174
this.commentOnlyChangedFiles = rhs.commentOnlyChangedFiles;
7275
this.gitLabUrl = rhs.gitLabUrl;
73-
this.apiToken = rhs.apiToken;
7476
this.projectId = rhs.projectId;
7577
this.mergeRequestIid = rhs.mergeRequestIid;
7678
this.apiTokenCredentialsId = rhs.apiTokenCredentialsId;
@@ -116,9 +118,6 @@ public void applyDefaults(final ViolationsToGitLabGlobalConfiguration defaults)
116118
if (isNullOrEmpty(this.gitLabUrl)) {
117119
this.gitLabUrl = defaults.getGitLabUrl();
118120
}
119-
if (isNullOrEmpty(this.apiToken)) {
120-
this.apiToken = defaults.getApiToken();
121-
}
122121
if (isNullOrEmpty(this.apiTokenCredentialsId)) {
123122
this.apiTokenCredentialsId = defaults.getApiTokenCredentialsId();
124123
}
@@ -174,20 +173,11 @@ public void setProjectId(final String projectId) {
174173
this.projectId = projectId;
175174
}
176175

177-
@DataBoundSetter
178-
public void setApiTokenCredentialsId(final String apiTokenCredentialsId) {
179-
this.apiTokenCredentialsId = apiTokenCredentialsId;
180-
}
181-
182176
@DataBoundSetter
183177
public void setAuthMethodHeader(final Boolean authMethodHeader) {
184178
this.authMethodHeader = authMethodHeader;
185179
}
186180

187-
public String getApiToken() {
188-
return apiToken;
189-
}
190-
191181
public String getProjectId() {
192182
return projectId;
193183
}
@@ -255,9 +245,15 @@ public void setGitLabUrl(final String gitLabUrl) {
255245
this.gitLabUrl = gitLabUrl;
256246
}
257247

248+
public void setApiTokenCredentialsId(final String apiTokenCredentialsId) {
249+
this.apiTokenCredentialsId = apiTokenCredentialsId;
250+
}
251+
258252
@DataBoundSetter
253+
@Deprecated
259254
public void setApiToken(final String apiToken) {
260-
this.apiToken = apiToken;
255+
throw new RuntimeException(
256+
"Setting raw API token is removed, set the apiTokenCredentialsId with a string credential instead!");
261257
}
262258

263259
@Override
@@ -275,7 +271,6 @@ public boolean equals(final Object o) {
275271
&& createSingleFileComments == that.createSingleFileComments
276272
&& Objects.equals(violationConfigs, that.violationConfigs)
277273
&& Objects.equals(gitLabUrl, that.gitLabUrl)
278-
&& Objects.equals(apiToken, that.apiToken)
279274
&& Objects.equals(projectId, that.projectId)
280275
&& Objects.equals(mergeRequestIid, that.mergeRequestIid)
281276
&& Objects.equals(mergeRequestId, that.mergeRequestId)
@@ -302,7 +297,6 @@ public int hashCode() {
302297
createSingleFileComments,
303298
violationConfigs,
304299
gitLabUrl,
305-
apiToken,
306300
projectId,
307301
mergeRequestIid,
308302
mergeRequestId,

‎src/main/java/org/jenkinsci/plugins/jvctgl/config/ViolationsToGitLabConfigHelper.java‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,6 @@ public class ViolationsToGitLabConfigHelper {
1111
public static final String FIELD_PARSER = "parser";
1212
public static final String FIELD_PROJECTID = "projectId";
1313
public static final String FIELD_MERGEREQUESTIID = "mergeRequestIid";
14-
public static final String FIELD_APITOKEN = "apiToken";
15-
public static final String FIELD_USEAPITOKENCREDENTIALS = "useApiTokenCredentials";
16-
public static final String FIELD_USEAPITOKEN = "useApiToken";
1714
public static final String FIELD_APITOKENCREDENTIALSID = "apiTokenCredentialsId";
1815
public static final String FIELD_IGNORECERTIFICATEERRORS = "ignoreCertificateErrors";
1916
public static final String FIELD_APITOKENPRIVATE = "apiTokenPrivate";

‎src/main/java/org/jenkinsci/plugins/jvctgl/perform/JvctglPerformer.java‎

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66
import static com.google.common.base.Throwables.propagate;
77
import static com.google.common.collect.Lists.newArrayList;
88
import static java.util.logging.Level.SEVERE;
9-
import static org.jenkinsci.plugins.jvctgl.config.ViolationsToGitLabConfigHelper.FIELD_APITOKEN;
109
import static org.jenkinsci.plugins.jvctgl.config.ViolationsToGitLabConfigHelper.FIELD_APITOKENCREDENTIALSID;
1110
import static org.jenkinsci.plugins.jvctgl.config.ViolationsToGitLabConfigHelper.FIELD_APITOKENPRIVATE;
1211
import static org.jenkinsci.plugins.jvctgl.config.ViolationsToGitLabConfigHelper.FIELD_AUTHMETHODHEADER;
@@ -60,7 +59,7 @@ public class JvctglPerformer {
6059
@VisibleForTesting
6160
public static void doPerform(
6261
final ViolationsToGitLabConfig config,
63-
final Optional<StringCredentials> apiTokenCredentials,
62+
final String apiToken,
6463
final File workspace,
6564
final TaskListener listener)
6665
throws MalformedURLException {
@@ -99,14 +98,6 @@ public static void doPerform(
9998
}
10099
}
101100

102-
String apiToken = config.getApiToken();
103-
if (apiTokenCredentials.isPresent()) {
104-
apiToken = apiTokenCredentials.get().getSecret().getPlainText();
105-
}
106-
if (isNullOrEmpty(apiToken)) {
107-
throw new IllegalStateException("No credentials found!");
108-
}
109-
110101
final String hostUrl = config.getGitLabUrl();
111102
final String projectId = config.getProjectId();
112103
final String mergeRequestIid = config.getMergeRequestIid();
@@ -181,8 +172,6 @@ static ViolationsToGitLabConfig expand(
181172
expanded.setProjectId(environment.expand(config.getProjectId()));
182173
expanded.setMergeRequestIid(environment.expand(config.getMergeRequestIid()));
183174

184-
expanded.setApiToken(config.getApiToken());
185-
186175
expanded.setApiTokenCredentialsId(config.getApiTokenCredentialsId());
187176

188177
expanded.setAuthMethodHeader(config.getAuthMethodHeader());
@@ -259,7 +248,11 @@ public Void invoke(final File workspace, final VirtualChannel channel)
259248
throws IOException, InterruptedException {
260249
setupFindBugsMessages();
261250
listener.getLogger().println("Workspace: " + workspace.getAbsolutePath());
262-
doPerform(configExpanded, apiTokenCredentials, workspace, listener);
251+
doPerform(
252+
configExpanded,
253+
apiTokenCredentials.get().getSecret().getPlainText(),
254+
workspace,
255+
listener);
263256
return null;
264257
}
265258
});
@@ -279,8 +272,6 @@ private static void logConfiguration(
279272
logger.println(FIELD_PROJECTID + ": " + config.getProjectId());
280273
logger.println(FIELD_MERGEREQUESTIID + ": " + config.getMergeRequestIid());
281274

282-
logger.println(FIELD_APITOKEN + ": " + !isNullOrEmpty(config.getApiToken()));
283-
284275
logger.println(
285276
FIELD_APITOKENCREDENTIALSID + ": " + !isNullOrEmpty(config.getApiTokenCredentialsId()));
286277
logger.println(FIELD_IGNORECERTIFICATEERRORS + ": " + config.getIgnoreCertificateErrors());

‎src/main/resources/org/jenkinsci/plugins/jvctgl/ViolationsToGitLabGlobalConfiguration/config.jelly‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,17 +9,9 @@
99
xmlns:c="/lib/credentials">
1010
<f:section title="GitLab Violations Server Defaults">
1111

12-
<f:optionalBlock checked="${!empty instance.apiTokenCredentialsId}" title="Specify API token from credentials" inline="true">
13-
<f:entry title="API token Crendential" field="apiTokenCredentialsId">
14-
<c:select />
15-
</f:entry>
16-
</f:optionalBlock>
17-
18-
<f:optionalBlock checked="${!empty instance.apiToken}" title="Specify API token here" inline="true">
19-
<f:entry title="OAuth2 token" field="apiToken">
20-
<f:password />
21-
</f:entry>
22-
</f:optionalBlock>
12+
<f:entry title="API token Crendential" field="apiTokenCredentialsId">
13+
<c:select />
14+
</f:entry>
2315

2416
<f:entry title="Private token" field="apiTokenPrivate">
2517
<f:checkbox/>

‎src/main/resources/org/jenkinsci/plugins/jvctgl/config/ViolationsToGitLabConfig/config.jelly‎

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,23 +8,12 @@
88
xmlns:t="/lib/hudson"
99
xmlns:c="/lib/credentials">
1010

11-
<f:optionalBlock checked="${!empty instance.apiTokenCredentialsId}" title="Specify API token from credentials" inline="true">
12-
<f:entry title="API token Crendential" field="apiTokenCredentialsId">
11+
<f:entry title="API token Crendential" field="apiTokenCredentialsId">
1312
<c:select />
1413
<f:description>
1514
Will default to global config.
1615
</f:description>
17-
</f:entry>
18-
</f:optionalBlock>
19-
20-
<f:optionalBlock checked="${!empty instance.apiToken}" title="Specify API token here" inline="true">
21-
<f:entry title="OAuth2 token" field="apiToken">
22-
<f:password />
23-
<f:description>
24-
Will default to global config.
25-
</f:description>
26-
</f:entry>
27-
</f:optionalBlock>
16+
</f:entry>
2817

2918
<f:optionalBlock checked="${!empty instance.proxyUri}" title="Use proxy" inline="true">
3019
<f:entry title="URI" field="proxyUri">

0 commit comments

Comments
 (0)