Password in clear text

[jetersen]

The way you use credentials plugin is bad, you should never put the password in clear text, which you do several times through logging and in config xml 🙈 🙉 🙊
Working on a PR that fixes a lot of your jelly hacking and going to deprecate the use of username and password.

[jetersen]

Takes the credentials and paste it into clear text

violation-comments-to-stash-plugin/src/main/java/org/jenkinsci/plugins/jvctb/perform/JvctbPerformer.java

Lines 257 to 284 in 0e85c4f

	private static void setCredentialsIfExists(
	final TaskListener listener, final ViolationsToBitbucketServerConfig configExpanded) {
	if (configExpanded.isUseUsernamePasswordCredentials()) {
	if (!isNullOrEmpty(configExpanded.getUsernamePasswordCredentialsId())) {
	final Optional<StandardUsernamePasswordCredentials> credentials =
	findCredentials(configExpanded.getUsernamePasswordCredentialsId());
	if (credentials.isPresent()) {
	final String username =
	checkNotNull(
	emptyToNull(credentials.get().getUsername()),
	"Credentials username selected but not set!");
	final String password =
	checkNotNull(
	emptyToNull(credentials.get().getPassword().getPlainText()),
	"Credentials password selected but not set!");
	configExpanded.setUsername(username);
	configExpanded.setPassword(password);
	listener.getLogger().println("Using username and password from credentials");
	} else {
	listener.getLogger().println("Credentials not found!");
	return;
	}
	} else {
	listener.getLogger().println("Credentials checked but not selected!");
	return;
	}
	}
	}

if I then go and save any configuration afterwards the password is now in clear text on the Jenkins instance

😭

violation-comments-to-stash-plugin/src/main/java/org/jenkinsci/plugins/jvctb/perform/JvctbPerformer.java

Line 235 in 0e85c4f

logger.println(FIELD_PASSWORD + ": " + !isNullOrEmpty(config.getPassword()));

[tomasbjerre]

Nice! It all sounds very good!

I am generally a bit frustrated about the terrible API:s in Jenkins. And credentials is not an exception. Undocumented, lots of deprications and just very unclear how it should be used. Often feels like things are unnecessary complex... So your refactorings are more than welcome =)

Your findings probably needs fixing in these plugins as well:

• https://github.com/jenkinsci/violation-comments-to-gitlab-plugin
• https://github.com/jenkinsci/violation-comments-to-github-plugin

[jetersen]

@tomasbjerre after a little tweaking. I got this.

Current progress on simplified generator:

ViolationsToBitbucketServer([violationConfigs: [[parser: 'ANDROIDLINT', pattern: 'b', reporter: 'a'], [parser: 'CHECKSTYLE', pattern: 'b', reporter: 'a']]])

In the process of deprecating username, password 👍

[jetersen]

whats the default behaviour between create one comment per violation and create one big comment with all violations

[tomasbjerre]

I think the first one is most used. I would vote for that being default.

[tomasbjerre]

This is now released in 1.65. Thanks again for this!!