Added ability to construct a set of sensitive build variables.

Added AbstractBuild.getSensitiveBuildVariables which returns a set of variable
names which contain sensitive information that should not be exposed in
display output. This set is expected to consist of a subset of the keys in the
map returned by getBuildVariables.

Added method to allow ParamaterValues to indicate whether or not they have
sensitive information. Make PasswordParameterValue use this to indicate that
it does.

Give BuildWrappers a way to indicate what variables they contributed to a build
should be considered sensitive.



git-svn-id: https://hudson.dev.java.net/svn/hudson/trunk/hudson/main@35079 71c3de6d-444a-0410-be80-ed276b4c234a

core/src/main/java/hudson/model/AbstractBuild.java

 /*
  * The MIT License
  *
- * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
+ * Copyright (c) 2004-2010, Sun Microsystems, Inc., Kohsuke Kawaguchi, Yahoo! Inc.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -714,6 +714,36 @@ public abstract class AbstractBuild<P extends AbstractProject<P,R>,R extends Abs
         return getTimestamp();
     }
 
+    /**
+     * Builds up a set of variable names that contain sensitive values that
+     * should not be exposed. The expection is that this set is populated with
+     * keys returned by {@link #getBuildVariables()} that should have their
+     * values masked for display purposes.
+     *
+     * @since 1.378
+     */
+    public Set<String> getSensitiveBuildVariables() {
+        Set<String> s = new HashSet<String>();
+
+        ParametersAction parameters = getAction(ParametersAction.class);
+        if (parameters != null) {
+            for (ParameterValue p : parameters) {
+                if (p.isSensitive()) {
+                    s.add(p.getName());
+                }
+            }
+        }
+
+        // Allow BuildWrappers to determine if any of their data is sensitive
+        if (project instanceof BuildableItemWithBuildWrappers) {
+            for (BuildWrapper bw : ((BuildableItemWithBuildWrappers) project).getBuildWrappersList()) {
+                bw.makeSensitiveBuildVariables(this, s);
+            }
+        }
+        
+        return s;
+    }
+
     /**
      * Provides additional variables and their values to {@link Builder}s.
      *

core/src/main/java/hudson/model/ParameterValue.java

 /*
  * The MIT License
  * 
- * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Tom Huybrechts
+ * Copyright (c) 2004-2010, Sun Microsystems, Inc., Kohsuke Kawaguchi, Tom Huybrechts,
+ *      Yahoo! Inc.
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -236,4 +237,18 @@ public abstract class ParameterValue implements Serializable {
     public String getShortDescription() {
         return toString();
     }
+
+    /**
+     * Returns whether the information contained in this ParameterValue is
+     * sensitive or security related. Used to determine whether the value
+     * provided by this object should be masked in output.
+     *
+     * <p>
+     * Subclasses can override this to control the returne value.
+     *
+     * @since 1.378
+     */
+    public boolean isSensitive() {
+        return false;
+}
 }

core/src/main/java/hudson/model/PasswordParameterValue.java

 /*
  * The MIT License
  *
- * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi, Romain Seguy
+ * Copyright (c) 2004-2010, Sun Microsystems, Inc., Kohsuke Kawaguchi, Romain Seguy, Yahoo! Inc.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -63,4 +63,9 @@ public class PasswordParameterValue extends ParameterValue {
             }
         };
     }
+
+    @Override
+    public boolean isSensitive() {
+        return true;
+}
 }

core/src/main/java/hudson/tasks/BuildWrapper.java

 /*
  * The MIT License
  * 
- * Copyright (c) 2004-2009, Sun Microsystems, Inc., Kohsuke Kawaguchi
+ * Copyright (c) 2004-2010, Sun Microsystems, Inc., Kohsuke Kawaguchi, Yahoo! Inc.
  * 
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -35,6 +35,7 @@ import java.io.OutputStream;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.Map;
+import java.util.Set;
 
 /**
  * Pluggability point for performing pre/post actions for the build process.
@@ -247,6 +248,22 @@ public abstract class BuildWrapper extends AbstractDescribableImpl<BuildWrapper>
     	// noop
     }
 
+    /**
+     * Called to define sensitive build variables. This provides an opportunity
+     * for a BuildWrapper to denote the names of variables that are sensitive in
+     * nature and should not be exposed in output.
+     *
+     * @param build
+     *      The build in progress for which this {@link BuildWrapper} is called. Never null.
+     * @param sensitiveVariables
+     *      Contains names of sensitive build variables. Names of sensitive variables
+     *      that were added with {@link #makeBuildVariables(hudson.model.AbstractBuild, java.util.Map)}
+     * @since 1.378
+     */
+    public void makeSensitiveBuildVariables(AbstractBuild build, Set<String> sensitiveVariables) {
+        // noop
+    }
+    
     /**
      * Returns all the registered {@link BuildWrapper} descriptors.
      */

test/src/test/java/hudson/model/ParametersTest.java

@@ -8,6 +8,7 @@ import com.gargoylesoftware.htmlunit.html.HtmlElement;
 import com.gargoylesoftware.htmlunit.html.HtmlTextInput;
 import com.gargoylesoftware.htmlunit.html.HtmlCheckBoxInput;
 import com.gargoylesoftware.htmlunit.html.HtmlOption;
+import java.util.Set;
 
 /**
  * @author huybrechts
@@ -102,4 +103,57 @@ public class ParametersTest extends HudsonTestCase {
         assertNotNull(builder.getEnvVars());
         assertEquals("Choice <2>", builder.getEnvVars().get("CHOICE"));
     }
+
+    public void testSensitiveParameters() throws Exception {
+        FreeStyleProject project = createFreeStyleProject();
+        ParametersDefinitionProperty pdb = new ParametersDefinitionProperty(
+                new PasswordParameterDefinition("password", "12345", "password description"));
+        project.addProperty(pdb);
+
+        CaptureEnvironmentBuilder builder = new CaptureEnvironmentBuilder();
+        project.getBuildersList().add(builder);
+
+        FreeStyleBuild build = project.scheduleBuild2(0).get();
+        Set<String> sensitiveVars = build.getSensitiveBuildVariables();
+
+        assertNotNull(sensitiveVars);
+        assertTrue(sensitiveVars.contains("password"));
+}
+
+    public void testNonSensitiveParameters() throws Exception {
+        FreeStyleProject project = createFreeStyleProject();
+        ParametersDefinitionProperty pdb = new ParametersDefinitionProperty(
+                new StringParameterDefinition("string", "defaultValue", "string description"));
+        project.addProperty(pdb);
+
+        CaptureEnvironmentBuilder builder = new CaptureEnvironmentBuilder();
+        project.getBuildersList().add(builder);
+
+        FreeStyleBuild build = project.scheduleBuild2(0).get();
+        Set<String> sensitiveVars = build.getSensitiveBuildVariables();
+
+        assertNotNull(sensitiveVars);
+        assertFalse(sensitiveVars.contains("string"));
+    }
+
+    public void testMixedSensitivity() throws Exception {
+        FreeStyleProject project = createFreeStyleProject();
+        ParametersDefinitionProperty pdb = new ParametersDefinitionProperty(
+                new StringParameterDefinition("string", "defaultValue", "string description"),
+                new PasswordParameterDefinition("password", "12345", "password description"),
+                new StringParameterDefinition("string2", "Value2", "string description")
+        );
+        project.addProperty(pdb);
+
+        CaptureEnvironmentBuilder builder = new CaptureEnvironmentBuilder();
+        project.getBuildersList().add(builder);
+
+        FreeStyleBuild build = project.scheduleBuild2(0).get();
+        Set<String> sensitiveVars = build.getSensitiveBuildVariables();
+
+        assertNotNull(sensitiveVars);
+        assertFalse(sensitiveVars.contains("string"));
+        assertTrue(sensitiveVars.contains("password"));
+        assertFalse(sensitiveVars.contains("string2"));
+    }
 }