SecretBuildWrapper needs to initialize its pattern lazily

jenkinsci · Jun 23, 2021 · 6dc28f0 · 6dc28f0
1 parent 958f395
commit 6dc28f0
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 13 deletions.
diff --git a/src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/BindingStep.java b/src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/BindingStep.java
@@ -216,8 +216,8 @@ private Object readResolve() throws ObjectStreamException {
             return this;
         }
 
-        @Override public OutputStream decorateLogger(AbstractBuild _ignore, final OutputStream logger) throws IOException, InterruptedException {
-            return new SecretPatterns.MaskingOutputStream(logger, Pattern.compile(pattern.getPlainText()), charsetName);
+        @Override public OutputStream decorateLogger(AbstractBuild _ignore, OutputStream logger) throws IOException, InterruptedException {
+            return new SecretPatterns.MaskingOutputStream(logger, () -> Pattern.compile(pattern.getPlainText()), charsetName);
         }
 
     }

diff --git a/src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/SecretBuildWrapper.java b/src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/SecretBuildWrapper.java
@@ -139,8 +139,8 @@ private static final class Filter extends ConsoleLogFilter {
             this.charsetName = charsetName;
         }
 
-        @Override public OutputStream decorateLogger(final AbstractBuild build, final OutputStream logger) throws IOException, InterruptedException {
-            return new SecretPatterns.MaskingOutputStream(logger, getPatternForBuild(build), charsetName) {
+        @Override public OutputStream decorateLogger(AbstractBuild build, OutputStream logger) throws IOException, InterruptedException {
+            return new SecretPatterns.MaskingOutputStream(logger, () -> getPatternForBuild(build), charsetName) {
                 @Override public void close() throws IOException {
                     super.close();
                     secretsForBuild.remove(build);

diff --git a/src/main/java/org/jenkinsci/plugins/credentialsbinding/masking/SecretPatterns.java b/src/main/java/org/jenkinsci/plugins/credentialsbinding/masking/SecretPatterns.java
@@ -31,6 +31,7 @@
 import java.io.OutputStream;
 import java.util.Collection;
 import java.util.Comparator;
+import java.util.function.Supplier;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
@@ -67,32 +68,36 @@ public class SecretPatterns {
      */
     public static class MaskingOutputStream extends LineTransformationOutputStream.Delegating {
 
-        private final @CheckForNull Pattern secretPattern;
+        private final @NonNull Supplier<Pattern> secretPattern;
         private final @NonNull String charsetName;
+        private @CheckForNull Pattern p;
 
         /**
          * @param out the base output stream which will not be sent secrets
-         * @param secretPattern the result of {@link #getAggregateSecretPattern}, or null to just skip masking
+         * @param secretPattern a lazy computation of either the result of {@link #getAggregateSecretPattern}, or null to just skip masking
          * @param charsetName the character set to detect strings
          */
-        public MaskingOutputStream(@NonNull OutputStream out, @CheckForNull Pattern secretPattern, @NonNull String charsetName) {
+        public MaskingOutputStream(@NonNull OutputStream out, @NonNull Supplier<Pattern> secretPattern, @NonNull String charsetName) {
             super(out);
             this.secretPattern = secretPattern;
             this.charsetName = charsetName;
         }
 
         @Override protected void eol(byte[] b, int len) throws IOException {
-            if (secretPattern != null && !secretPattern.toString().isEmpty()) {
-                Matcher m = secretPattern.matcher(new String(b, 0, len, charsetName));
+            if (p == null) {
+                p = secretPattern.get();
+            }
+            if (p == null || p.toString().isEmpty()) {
+                // Avoid byte → char → byte conversion unless we are actually doing something.
+                out.write(b, 0, len);
+            } else {
+                Matcher m = p.matcher(new String(b, 0, len, charsetName));
                 if (m.find()) {
                     out.write(m.replaceAll("****").getBytes(charsetName));
                 } else {
-                    // Avoid byte → char → byte conversion unless we are actually doing something.
+                    // As above.
                     out.write(b, 0, len);
                 }
-            } else {
-                // Avoid byte → char → byte conversion unless we are actually doing something.
-                out.write(b, 0, len);
             }
         }