Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Insecure bash secret usage in bash script #1030

Closed
braisvq1996 opened this issue Sep 7, 2023 · 0 comments · Fixed by #1042
Closed

Insecure bash secret usage in bash script #1030

braisvq1996 opened this issue Sep 7, 2023 · 0 comments · Fixed by #1042
Labels
bug Something isn't working

Comments

@braisvq1996
Copy link
Contributor

Describe the bug
Insecure bash secret usage in bash script. After the last jenkins update to version 2.387.3 we are getting a warning in the pipeline about insceure usage of credentials.

To Reproduce
Steps to reproduce the behavior:

  1. Update ODS installation to the latest version
  2. Update ODS project to the latest version
  3. execute any component pipeline from an ods or ods-service component
  4. See warning

Expected behavior
A clear and concise description of what you expected to happen.

Screenshots
image

Affected version (please complete the following information):

  • OpenShift: 4.12.x
  • OpenDevStack 4.3.0

Log Output (ensure to remove any confidential information like tokens, project names, etc.

Running on [pod-bfb1a3fd-08fb-4cef-995d-5b2c91c68dde-5wxr3-38m86](https://https://jenkins-ods-cd.openshift.com/manage/computer/pod-bfb1a3fd-08fb-4cef-995d-5b2c91c68dde-5wxr3-38m86/) in /tmp/workspace/smart-cd/ods-cd-cypress-test
[Pipeline] {
[Pipeline] withCredentials
Masking supported pattern matches of $TOKEN
[Pipeline] {
[Pipeline] }
[Pipeline] // withCredentials
[Pipeline] withCredentials
Masking supported pattern matches of $TOKEN
[Pipeline] {
[Pipeline] sh (Set bitbucket build status via API)
Warning: A secret was passed to "sh" using Groovy String interpolation, which is insecure.
		 Affected argument(s) used the following variable(s): [TOKEN]
		 See https://jenkins.io/redirect/groovy-string-interpolation for details.
+ curl --fail -sS --request POST --header 'Authorization: Bearer ****' --header 'Content-Type: application/json' --data '{"state":"INPROGRESS","key":"89759ebb","name":"89759ebb","url":"https://jenkins-ods-cd.openshift.com/job/ods-cd/job/ods-cd-cypress-test/28/"}' https://bitbucket.com/rest/build-status/1.0/commits/89759ebb7bb2b373010fe65ea25208627cc516f0
[Pipeline] }
[Pipeline] // withCredentials
[Pipeline] wrap
[Pipeline] {
[Pipeline] sh (Check if Git LFS is enabled)
@braisvq1996 braisvq1996 added the bug Something isn't working label Sep 7, 2023
serverhorror added a commit to serverhorror/ods-jenkins-shared-library that referenced this issue Oct 11, 2023
fixes Insecure bash secret usage in bash script opendevstack#1030
serverhorror added a commit to serverhorror/ods-jenkins-shared-library that referenced this issue Oct 11, 2023
fixes Insecure bash secret usage in bash script opendevstack#1030
serverhorror added a commit to serverhorror/ods-jenkins-shared-library that referenced this issue Oct 17, 2023
fixes Insecure bash secret usage in bash script opendevstack#1030
serverhorror added a commit to serverhorror/ods-jenkins-shared-library that referenced this issue Oct 17, 2023
fixes Insecure bash secret usage in bash script opendevstack#1030
serverhorror added a commit to serverhorror/ods-jenkins-shared-library that referenced this issue Oct 17, 2023
fixes Insecure bash secret usage in bash script opendevstack#1030
serverhorror added a commit to serverhorror/ods-jenkins-shared-library that referenced this issue Oct 17, 2023
fixes Insecure bash secret usage in bash script opendevstack#1030
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant