opendevstack / ods-jenkins-shared-library

Shared Jenkins library which all ODS projects & components use - provisioning, SonarQube code scanning, Nexus publishing, OpenShift template based deployments and repository orchestration
Apache License 2.0
72 stars 57 forks source link

Insecure bash secret usage in bash script #1030

Closed BraisVQ closed 11 months ago

BraisVQ commented 1 year ago

Describe the bug Insecure bash secret usage in bash script. After the last jenkins update to version 2.387.3 we are getting a warning in the pipeline about insceure usage of credentials.

To Reproduce Steps to reproduce the behavior:

  1. Update ODS installation to the latest version
  2. Update ODS project to the latest version
  3. execute any component pipeline from an ods or ods-service component
  4. See warning

Expected behavior A clear and concise description of what you expected to happen.

Screenshots image

Affected version (please complete the following information):

Log Output (ensure to remove any confidential information like tokens, project names, etc.

Running on [pod-bfb1a3fd-08fb-4cef-995d-5b2c91c68dde-5wxr3-38m86](https://https://jenkins-ods-cd.openshift.com/manage/computer/pod-bfb1a3fd-08fb-4cef-995d-5b2c91c68dde-5wxr3-38m86/) in /tmp/workspace/smart-cd/ods-cd-cypress-test
[Pipeline] {
[Pipeline] withCredentials
Masking supported pattern matches of $TOKEN
[Pipeline] {
[Pipeline] }
[Pipeline] // withCredentials
[Pipeline] withCredentials
Masking supported pattern matches of $TOKEN
[Pipeline] {
[Pipeline] sh (Set bitbucket build status via API)
Warning: A secret was passed to "sh" using Groovy String interpolation, which is insecure.
         Affected argument(s) used the following variable(s): [TOKEN]
         See https://jenkins.io/redirect/groovy-string-interpolation for details.
+ curl --fail -sS --request POST --header 'Authorization: Bearer ****' --header 'Content-Type: application/json' --data '{"state":"INPROGRESS","key":"89759ebb","name":"89759ebb","url":"https://jenkins-ods-cd.openshift.com/job/ods-cd/job/ods-cd-cypress-test/28/"}' https://bitbucket.com/rest/build-status/1.0/commits/89759ebb7bb2b373010fe65ea25208627cc516f0
[Pipeline] }
[Pipeline] // withCredentials
[Pipeline] wrap
[Pipeline] {
[Pipeline] sh (Check if Git LFS is enabled)