[JENKINS-57319] Pipeline fails with incorrect type

[mezpahlan]

This is a second attempt to fix the token stored in plain text issue from #60. Hopefully this works with existing pipelines too.

An example of a secure pipeline would be:

stage ('Upload HockeyApp') {
	    environment { 
                HOCKETAPP_TOKEN = credentials('hockeyapp-secret') 
            }
		steps {
			hockeyApp applications: [
				[
				 	apiToken: env.HOCKETAPP_TOKEN, 
					downloadAllowed: true, 
					filePath: 'sample.apk', 
					mandatory: false, 
					notifyTeam: true, 
					releaseNotesMethod: changelog(), 
					uploadMethod: appCreation(false)
				]
			], debugMode: false, failGracefully: false
		}		
	}

You will need to create a secure credential in Jenkins of type Secret text and refer to it by its id in a pipeline.

[mezpahlan]

Hi @njtman would you mind testing out 1.5.1 of the plugin. I have made a fix that I think might work for both freestyle and pipeline projects. You can find the build artefacts on the CI server https://ci.jenkins.io/blue/organizations/jenkins/Plugins%2Fhockeyapp-plugin/detail/PR-61/2/artifacts

Many thanks.

[imod]

@mezpahlan I just tested your 1.5.1-SNAPSHOT and it worked - actually, it does not need to use the credentials, your fix allows the user to do what he wants: hard coding or using credentials store as shown above...

[mezpahlan]

Thanks @imod can I also double check if you use the pipeline or a freestyle project?

[imod]

I use a pipeline (declarative)

[mezpahlan]

Ok fab. I'm waiting on one other tester to respond but will release this fix at the end of tomorrow or earlier if they do.

Sorry again for the trouble.

[njtman]

Hi @mezpahlan, yes I can confirm that your plugin version 1.5.1-SNAPSHOT is working as expected.

[njtman]

@mezpahlan Now that this is released (and I'm assuming the plain text vulnerability has been resolved), is it possible to have the warning removed from the Jenkins vulnerability feed?

[mezpahlan]

@njtman To be honest I don't know how to remove that message, it's not set by me. If you haven't changed your credentials then I suppose the vulnerability still remains. Not the storing of the token in plain text, that's been fixed, but the fact that at some point in the past it was in plain text. I suppose anyone could have seen it in the past.

I'll ping the Jenkins Dev mailing list to see what they recommend. For now what I will say is if you can change your token do.