Mask Regexes and Global option #6

jantman · 2016-08-04T15:02:36Z

This pull request adds two major features to the Mask Passwords plugin:

The ability to mask user-defined regular expressions in addition to passwords. This is useful because (a) it doesn't require defining the password explicitly in the configuration and, (b) it supports masking secrets that aren't known ahead of time. Our use case is AWS credentials; the AWS secret key portion of credentials matches (?<![A-Za-z0-9/+=])[A-Za-z0-9/+=]{40}(?![A-Za-z0-9/+=]). The previous Mask Passwords implementation caused problems for jobs that use temporary credentials, or that generate their own credentials and echo them in the job's output.
The ability to enable the plugin globally. This is implented as a ConsoleLogFilter not inside a BuildWrapper, i.e. a global ConsoleLogFilter. The implementation checks the plugin's global configuration, and only decorates the logger if the global enable setting is true. I'm aware that this is probably a bad thing for most users, and have done my best to make the help messages very clear for that. However, for some users (such as myself) who don't have centralized control over job configuration (i.e. anyone in the organization can add or modify jobs), this is necessary in order to suppress credentials from being logged.

I've tested this manually to the best of my abilities using both Jenkins 1.609.1 (as set in pom.xml) as well as the official Docker images of 1.625.2 and 2.7.1.

…king of global passwords and regexes, regardless of job configuration

…ling isn't working

scoheb · 2016-08-09T14:44:30Z

README.md

@@ -4,7 +4,7 @@ Copyright &copy; 2010-2011, Manufacture Francaise des Pneumatiques Michelin, Rom

 About this plugin
 -----------------
-The Mask Passwords plugin is meant to be used from [Hudson][1] or [Jenkins][2] to mask passwords which may appear from builds' console. Please take a look at [Jenkins' wiki][3] to get detailed information.
+The Mask Passwords plugin is meant to be used from [Hudson][1] or [Jenkins][2] to mask passwords or regulat expressions which may appear from builds' console. Please take a look at [Jenkins' wiki][3] to get detailed information.


Oops. Apologies. Fix pushed up.

oleg-nenashev · 2016-08-09T15:01:45Z

README.md

@@ -4,7 +4,7 @@ Copyright &copy; 2010-2011, Manufacture Francaise des Pneumatiques Michelin, Rom

 About this plugin
 -----------------
-The Mask Passwords plugin is meant to be used from [Hudson][1] or [Jenkins][2] to mask passwords which may appear from builds' console. Please take a look at [Jenkins' wiki][3] to get detailed information.
+The Mask Passwords plugin is meant to be used from [Hudson][1] or [Jenkins][2] to mask passwords or regular expressions which may appear from builds' console. Please take a look at [Jenkins' wiki][3] to get detailed information.


This version is not compatible with Hudson anymore. Unrelated to this PR btw

Ok, shall I remove the Hudson link, while I'm touching the README?

jantman · 2016-08-09T15:14:30Z

@oleg-nenashev thanks so much for looking at this! About to go into a meeting, but will have those comments addressed within the next few hours.

oleg-nenashev · 2016-08-09T19:37:52Z

README.md

-[3]: http://wiki.jenkins-ci.org/display/JENKINS/Mask+Passwords+Plugin
-[4]: https://svn.jenkins-ci.org/trunk/hudson/plugins/mask-passwords/
-[5]: https://github.com/jenkinsci/mask-passwords-plugin
+[1]: http://jenkins-ci.org/


outdated link. Now it's https://jenkins.io. Not important btw

…ith Hudson retain old constructor signature for binary compatibility fix Jenkins link CheckForNull on VarMaskRegex equals method

jantman · 2016-08-10T10:34:50Z

@oleg-nenashev Thank you so much for your time on this. As is probably obvious, this is more Java than I've written in the last 10 years combined. Sorry if some of these issues should be relatively basic, but I really appreciate your time to help with this.

jantman · 2016-08-15T11:28:34Z

@oleg-nenashev I'm sure you're very busy, but would it be possible to get some feedback on my updates? I'm trying to figure out if I should wait for movement on this PR, or figure out how to distribute and install my forked version internally...

oleg-nenashev · 2016-09-02T12:20:37Z

@jantman sorry about the delay

jantman · 2016-09-15T14:42:08Z

@oleg-nenashev ok... any odds of getting some input on this?

jniesen · 2016-09-26T15:20:51Z

Is this still under review?

oleg-nenashev · 2016-09-26T15:31:42Z

It's somewhere in my TODO list, but I haven't have a chance to investigate this and other PRs in this plugin yet. I commonly do it in a burst (one plugin per weekend), but I have not reached this plugin yet

mryan43 · 2016-10-26T08:24:37Z

This looks very useful ! I'm going to test this internally as a snapshot version because we need this feature.

I have a slightly different requirement though, my problem is with output of passwords in mercurial URLs by the m2 release plugin, it displays in logs : hg push https://user:password@mercurial.my.org/repo, with password in cleartext.

The only way I know to mask this one is to put the releaser's mercurial credentials in global masked passwords wich is really bad because they change often and a failure to update the global passwords results in a clear text password in logs.

I'd like to use a regexp like this : :\/\/.*:(.*)@ and mask only the capture group instead of the whole match. Do you think it would be possible ?

mryan43 · 2016-10-26T11:50:50Z

FWI the snapshot version works like a charm for us, using regex and global activation, two great features ! Thanks a lot @jantman

jantman · 2016-11-08T17:24:24Z

Thanks so much!

jantman added 8 commits July 26, 2016 15:13

WIP - initial, partial work to add regex masking support

87b8d21

mask regexes as well

c6d1500

fix some UI elements

2f6b07b

configuration for global enabling of masking

9bd3c86

add ConsoleLogFilter to conditionally enable global (system-wide) mas…

59e8ac0

…king of global passwords and regexes, regardless of job configuration

WIP working on acceptance tests; trying to figure out why global enab…

24c2505

…ling isn't working

update help

3728d23

fix tests for global enabling

c924ede

scoheb reviewed Aug 9, 2016
View reviewed changes

fix typo in README

21198c0

oleg-nenashev self-assigned this Aug 9, 2016

oleg-nenashev reviewed Aug 9, 2016
View reviewed changes

jantman added 2 commits August 10, 2016 06:31

remove Hudson link from README; this plugin is no longer compatible w…

d65e0fe

…ith Hudson retain old constructor signature for binary compatibility fix Jenkins link CheckForNull on VarMaskRegex equals method

fixes per code review in pull request

dd9a0bd

jantman force-pushed the mask-regex-global-clf branch from c5fae04 to dd9a0bd Compare August 10, 2016 10:32

oleg-nenashev merged commit 237ffde into jenkinsci:master Nov 8, 2016

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Mask Regexes and Global option #6

Mask Regexes and Global option #6

jantman commented Aug 4, 2016

scoheb Aug 9, 2016

jantman Aug 9, 2016

oleg-nenashev Aug 9, 2016

jantman Aug 9, 2016

jantman commented Aug 9, 2016

oleg-nenashev Aug 9, 2016

jantman commented Aug 10, 2016

jantman commented Aug 15, 2016

oleg-nenashev commented Sep 2, 2016

jantman commented Sep 15, 2016

jniesen commented Sep 26, 2016

oleg-nenashev commented Sep 26, 2016

mryan43 commented Oct 26, 2016 •

edited

Loading

mryan43 commented Oct 26, 2016

jantman commented Nov 8, 2016

Mask Regexes and Global option #6

Mask Regexes and Global option #6

Conversation

jantman commented Aug 4, 2016

scoheb Aug 9, 2016

Choose a reason for hiding this comment

jantman Aug 9, 2016

Choose a reason for hiding this comment

oleg-nenashev Aug 9, 2016

Choose a reason for hiding this comment

jantman Aug 9, 2016

Choose a reason for hiding this comment

jantman commented Aug 9, 2016

oleg-nenashev Aug 9, 2016

Choose a reason for hiding this comment

jantman commented Aug 10, 2016

jantman commented Aug 15, 2016

oleg-nenashev commented Sep 2, 2016

jantman commented Sep 15, 2016

jniesen commented Sep 26, 2016

oleg-nenashev commented Sep 26, 2016

mryan43 commented Oct 26, 2016 • edited Loading

mryan43 commented Oct 26, 2016

jantman commented Nov 8, 2016

mryan43 commented Oct 26, 2016 •

edited

Loading