Skip to content

argumentsToString should never reflect text: 'stuff' #105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 31, 2021

Conversation

jglick
Copy link
Member

@jglick jglick commented Jun 28, 2021

Supersedes #104. @bwalding @imonteroperez

Note that if you were bitten by this issue, you were probably writing your Pipeline script using poor practices to begin with. For example,

def json = sh returnStdout: true, script: 'something-yielding-secret-JSON'
def object = readJSON text: json

can be rewritten as a first step to

def object
try {
  sh 'mkdir -p $WORKSPACE_TMP  && something-yielding-secret-JSON > $WORKSPACE_TMP/secret.json'
  object = readJSON file: "$WORKSPACE_TMP/secret.json"
} finally {
  sh 'rm -f $WORKSPACE_TMP/secret.json'
}

but better still is to never have this secret JSON text pass through Pipeline script at all:

sh 'something-yielding-secret-JSON | something-using-secret-JSON'

(Pipeline does not expect actual secrets to ever be exposed in plain text to Groovy code. withCredentials can be used to inject secrets from Jenkins to a build, but if secrets are produced within the build, there should be no reason for them to be loaded into orchestration logic itself.)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants