T09 · Insecure Skill Coding Practices
Warning
- Location
templates/config-jelly.md:25- Finding
Generated Jenkins Plugins May Persist Secrets as Plaintext Strings
- Content
View full analysis
` | `` | | `boolean` | `` | `` | | `int` | `` | `` | | `String`（多行） | `` | `` | | `String`（密钥） | `` | `` | | 枚举选择 | `` | `...` | ``` `references/jelly-reference.md:23-28`: ```xml ### `` — 密码输入框 ```xml ``` ``` `templates/plugin-configuration.md:11-23`: ```java public class PluginConfiguration extends AbstractDescribableImpl implements Serializable { private final String key; private final String value; @DataBoundConstructor public PluginConfiguration(String key, String value) { this.key = key; this.value = value; } public String getKey() { return key; } public String getValue() { return value; } ``` ### Technical Analysis The skill recommends using a Java `String` for a secret and binding it to Jenkins' `` form control. This control masks the value in the browser but does not, by itself, provide encrypted server-side storage. The accompanying persistent-configuration template stores configurat ...[truncated 2025 chars]- Remediation
View remediation
` for masked input, but explicitly document that it only protects browser presentation and must be paired with `Secret` for protected persistence. 3. Convert a secret to plaintext only at the final authorized use point: ```java String tokenValue = Secret.toString(apiToken); ``` Do not log, serialize separately, or return `tokenValue` through Stapler-accessible methods. 4. Create separate templates for ordinary configuration values and confidential values. Do not describe a secret as a "`String` (secret)" field. 5. Review generated getters and UI exposure. Avoid methods that unnecessarily return plaintext credentials, and ensure secret values are not included in logs, exception messages, build output, telemetry, or generated README examples. 6. Add tests that save and reload plugin configuration and verify that the raw credential does not appear in the resulting Jenkins XML configuration file. 7. Update both `templates/config-jelly.md` and `references/jelly-reference.md` with a warning and a complete `Secret`-backed Java example so future generated plugins consistently use encrypted-at-rest Jenkins configuration semantics. ]]>