Merge branch 'bugfix-72412' of https://github.com/gallardo/credential…

…s-binding-plugin into one-char-JENKINS-72412
jenkinsci · Apr 24, 2024 · b3559cf · b3559cf
2 parents 50eda2a + 89bbe4e
commit b3559cf
Show file tree

Hide file tree

Showing 3 changed files with 42 additions and 2 deletions.
diff --git a/...ain/java/org/jenkinsci/plugins/credentialsbinding/masking/Base64SecretPatternFactory.java b/...ain/java/org/jenkinsci/plugins/credentialsbinding/masking/Base64SecretPatternFactory.java
@@ -38,8 +38,13 @@ public Collection<String> getBase64Forms(@NonNull String secret) {
                 String shiftedSecret = shift + secret;
                 String encoded = encoder.encodeToString(shiftedSecret.getBytes(StandardCharsets.UTF_8));
                 String processedEncoded = shift.length() > 0 ? encoded.substring(2 * shift.length()) : encoded;
-                result.add(processedEncoded);
-                result.add(removeTrailingEquals(processedEncoded));
+                if (!processedEncoded.isEmpty()) {
+                    result.add(processedEncoded);
+                }
+                String processedWithoutTrailingEquals = removeTrailingEquals(processedEncoded);
+                if (!processedWithoutTrailingEquals.isEmpty()) {
+                    result.add(removeTrailingEquals(processedEncoded));
+                }
             }
         }
         return result;

diff --git a/src/test/java/org/jenkinsci/plugins/credentialsbinding/impl/BindingStepTest.java b/src/test/java/org/jenkinsci/plugins/credentialsbinding/impl/BindingStepTest.java
@@ -321,6 +321,25 @@ public void widerRequiredContext() throws Throwable {
         });
     }
 
+    @Issue("JENKINS-72412")
+    @Test public void maskingOfOneCharSecretShouldNotMangleOutput() throws Throwable {
+        rr.then(r -> {
+            String credentialsId = "creds";
+            String secret = "a";
+            CredentialsProvider.lookupStores(r.jenkins).iterator().next().addCredentials(Domain.global(), new StringCredentialsImpl(CredentialsScope.GLOBAL, credentialsId, "sample", Secret.fromString(secret)));
+            WorkflowJob p = r.jenkins.createProject(WorkflowJob.class, "p");
+            p.setDefinition(new CpsFlowDefinition(""
+                + "node {\n"
+                + "  withCredentials([string(credentialsId: '" + credentialsId + "', variable: 'SECRET')]) {\n"
+                // forgot set +x, ran /usr/bin/env, etc.
+                + "    if (isUnix()) {sh 'echo $SECRET > oops'} else {bat 'echo %SECRET% > oops'}\n"
+                + "  }\n"
+                + "}", true));
+            WorkflowRun b = r.assertBuildStatusSuccess(p.scheduleBuild2(0).get());
+            r.assertLogContains("echo", b);
+        });
+    }
+
     @Issue("JENKINS-30326")
     @Test
     public void testGlobalBindingWithAuthorization() throws Throwable {

diff --git a/...java/org/jenkinsci/plugins/credentialsbinding/masking/Base64SecretPatternFactoryTest.java b/...java/org/jenkinsci/plugins/credentialsbinding/masking/Base64SecretPatternFactoryTest.java
@@ -9,10 +9,14 @@
 import org.jenkinsci.plugins.workflow.cps.CpsFlowDefinition;
 import org.jenkinsci.plugins.workflow.job.WorkflowJob;
 import org.jenkinsci.plugins.workflow.job.WorkflowRun;
+import org.junit.Assert;
 import org.junit.Rule;
 import org.junit.Test;
 import org.jvnet.hudson.test.JenkinsRule;
 
+import java.util.Collection;
+import java.util.List;
+
 public class Base64SecretPatternFactoryTest {
 
     @Rule
@@ -52,4 +56,16 @@ public void base64SecretsAreMaskedInLogs() throws Exception {
         j.assertLogContains("****", run);
         j.assertLogNotContains(SAMPLE_PASSWORD, run);
     }
+
+    @Test
+    public void base64FormsAreNotEmpty() {
+        Base64SecretPatternFactory factory = new Base64SecretPatternFactory();
+        List<String> secrets = List.of("", "s", "s3", "s3cr3t");
+
+        secrets.forEach(secret -> {
+            Collection<String> base64Forms = factory.getBase64Forms(secret);
+            Assert.assertTrue("Failed for secret: '" + secret + "'. Method returned an empty string.",
+                    base64Forms.stream().noneMatch(String::isEmpty));
+        });
+    }
 }