[JENKINS-42950] Support more credential masking scenarios

pom.xml

@@ -95,13 +95,13 @@
     <dependency>
       <groupId>org.jenkins-ci.plugins.workflow</groupId>
       <artifactId>workflow-durable-task-step</artifactId>
-      <version>2.5</version>
+      <version>2.12</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.jenkins-ci.plugins</groupId>
       <artifactId>durable-task</artifactId>
-      <version>1.13</version>
+      <version>1.14</version>
       <scope>test</scope>
     </dependency>
     <dependency>

src/main/java/org/jenkinsci/plugins/credentialsbinding/MultiBinding.java

@@ -37,22 +37,15 @@
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.Serializable;
-import java.util.ArrayList;
-import java.util.Collection;
 import java.util.Collections;
-import java.util.Comparator;
 import java.util.LinkedHashMap;
-import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import java.util.regex.Pattern;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
 import jenkins.model.Jenkins;
 import org.jenkinsci.plugins.credentialsbinding.impl.CredentialNotFoundException;
-import org.kohsuke.accmod.Restricted;
-import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.kohsuke.stapler.DataBoundConstructor;
 
 /**
@@ -169,32 +162,4 @@ public abstract MultiEnvironment bind(@Nonnull Run<?,?> build,
         return (BindingDescriptor<C>) super.getDescriptor();
     }
 
-    private static final Comparator<String> stringLengthComparator = new Comparator<String>() {
-        @Override
-        public int compare(String o1, String o2) {
-            return o2.length() - o1.length();
-        }
-    };
-
-    /**
-     * Utility method for turning a collection of secret strings into a single {@link String} for pattern compilation.
-     * @param secrets A collection of secret strings
-     * @return A {@link String} generated from that collection.
-     */
-    @Restricted(NoExternalUse.class)
-    public static String getPatternStringForSecrets(Collection<String> secrets) {
-        StringBuilder b = new StringBuilder();
-        List<String> sortedByLength = new ArrayList<String>(secrets);
-        Collections.sort(sortedByLength, stringLengthComparator);
-
-        for (String secret : sortedByLength) {
-            if (!secret.isEmpty()) {
-                if (b.length() > 0) {
-                    b.append('|');
-                }
-                b.append(Pattern.quote(secret));
-            }
-        }
-        return b.toString();
-    }
 }

src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/BindingStep.java

@@ -54,6 +54,7 @@
 
 import org.apache.commons.codec.Charsets;
 import org.jenkinsci.plugins.credentialsbinding.MultiBinding;
+import org.jenkinsci.plugins.credentialsbinding.masking.PatternMaskerProvider;
 import org.jenkinsci.plugins.workflow.steps.AbstractStepExecutionImpl;
 import org.jenkinsci.plugins.workflow.steps.BodyExecutionCallback;
 import org.jenkinsci.plugins.workflow.steps.BodyInvoker;
@@ -195,7 +196,7 @@ private static final class Filter extends ConsoleLogFilter implements Serializab
         private String charsetName;
 
         Filter(Collection<String> secrets, String charsetName) {
-            pattern = Secret.fromString(MultiBinding.getPatternStringForSecrets(secrets));
+            pattern = Secret.fromString(PatternMaskerProvider.getMaskingPattern(secrets).pattern());
             this.charsetName = charsetName;
         }
 

src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/SecretBuildWrapper.java

@@ -35,6 +35,7 @@
 import hudson.tasks.BuildWrapper;
 import hudson.tasks.BuildWrapperDescriptor;
 import org.jenkinsci.plugins.credentialsbinding.MultiBinding;
+import org.jenkinsci.plugins.credentialsbinding.masking.PatternMaskerProvider;
 import org.kohsuke.stapler.DataBoundConstructor;
 
 import javax.annotation.CheckForNull;
@@ -60,7 +61,7 @@ public class SecretBuildWrapper extends BuildWrapper {
      */
     public static @CheckForNull Pattern getPatternForBuild(@Nonnull AbstractBuild<?, ?> build) {
         if (secretsForBuild.containsKey(build)) {
-            return Pattern.compile(MultiBinding.getPatternStringForSecrets(secretsForBuild.get(build)));
+            return PatternMaskerProvider.getMaskingPattern(secretsForBuild.get(build));
         } else {
             return null;
         }

src/main/java/org/jenkinsci/plugins/credentialsbinding/masking/AbstractShellPatternMaskerProvider.java

@@ -0,0 +1,62 @@
+/*
+ * The MIT License
+ *
+ * Copyright (c) 2019 CloudBees, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.jenkinsci.plugins.credentialsbinding.masking;
+
+import javax.annotation.Nonnull;
+import java.util.Collection;
+import java.util.HashSet;
+import java.util.regex.Pattern;
+
+/**
+ * Convenient base class for PatternMaskerProvider implementations for shells.
+ */
+abstract class AbstractShellPatternMaskerProvider implements PatternMaskerProvider {
+
+    /**
+     * Performs any quoting/escaping necessary for the input string to be able to be surrounded in quotes and passed
+     * literally to a shell. This should not include the surrounding quotes.
+     */
+    abstract @Nonnull String getQuotedForm(@Nonnull String input);
+
+    /**
+     * Surrounds a string with the proper quote characters to make a quoted string for a shell.
+     */
+    abstract @Nonnull String surroundWithQuotes(@Nonnull String input);
+
+    /**
+     * Performs the inverse of {@link #getQuotedForm(String)}.
+     */
+    abstract @Nonnull String getUnquotedForm(@Nonnull String input);
+
+    @Override
+    public @Nonnull Collection<String> getAlternativeForms(@Nonnull String input) {
+        Collection<String> patterns = new HashSet<>();
+        String quotedForm = getQuotedForm(input);
+        patterns.add(Pattern.quote(quotedForm));
+        patterns.add(Pattern.quote(surroundWithQuotes(quotedForm)));
+        patterns.add(Pattern.quote(getUnquotedForm(input)));
+        return patterns;
+    }
+}

src/main/java/org/jenkinsci/plugins/credentialsbinding/masking/BashPatternMaskerProvider.java

@@ -0,0 +1,64 @@
+/*
+ * The MIT License
+ *
+ * Copyright (c) 2019 CloudBees, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.jenkinsci.plugins.credentialsbinding.masking;
+
+import hudson.Extension;
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
+
+import javax.annotation.Nonnull;
+import java.util.regex.Pattern;
+
+@Extension
+@Restricted(NoExternalUse.class)
+public class BashPatternMaskerProvider extends AbstractShellPatternMaskerProvider {
+
+    private static final Pattern QUOTED_CHARS = Pattern.compile("(\\\\)(\\\\?)");
+
+    @Override
+    @Nonnull String getQuotedForm(@Nonnull String input) {
+        StringBuilder sb = new StringBuilder(input.length());
+        for (int i = 0; i < input.length(); i++) {
+            char c = input.charAt(i);
+            if (c == '\'') {
+                sb.append("'\\''");
+            } else {
+                sb.append(c);
+            }
+        }
+        return sb.toString();
+    }
+
+    @Override
+    @Nonnull String surroundWithQuotes(@Nonnull String input) {
+        return "'" + input + "'";
+    }
+
+    @Override
+    @Nonnull String getUnquotedForm(@Nonnull String input) {
+        return QUOTED_CHARS.matcher(input).replaceAll("$2");
+    }
+
+}

src/main/java/org/jenkinsci/plugins/credentialsbinding/masking/BatchPatternMaskerProvider.java

@@ -0,0 +1,85 @@
+/*
+ * The MIT License
+ *
+ * Copyright (c) 2019 CloudBees, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.jenkinsci.plugins.credentialsbinding.masking;
+
+import hudson.Extension;
+import org.kohsuke.accmod.Restricted;
+import org.kohsuke.accmod.restrictions.NoExternalUse;
+
+import javax.annotation.Nonnull;
+import java.util.regex.Pattern;
+
+@Extension
+@Restricted(NoExternalUse.class)
+public class BatchPatternMaskerProvider extends AbstractShellPatternMaskerProvider {
+
+    // adapted from:
+    // https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/
+    // also from WindowsUtil in Jenkins
+
+    private static final Pattern CMD_METACHARS = Pattern.compile("[()%!^\"<>&|]");
+    private static final Pattern QUOTED_CHARS = Pattern.compile("(\\^)(\\^?)");
+
+    @Override
+    @Nonnull String getQuotedForm(@Nonnull String input) {
+        int end = input.length();
+        StringBuilder sb = new StringBuilder(end);
+        for (int i = 0; i < end; i++) {
+            int nrBackslashes = 0;
+            while (i < end && input.charAt(i) == '\\') {
+                i++;
+                nrBackslashes++;
+            }
+
+            if (i == end) {
+                // backslashes at the end of the argument must be escaped so the terminate quote isn't
+                nrBackslashes = nrBackslashes * 2;
+            } else if (input.charAt(i) == '"') {
+                // backslashes preceding a quote all need to be escaped along with the quote
+                nrBackslashes = nrBackslashes * 2 + 1;
+            }
+            // else backslashes have no special meaning and don't need to be escaped here
+
+            for (int j = 0; j < nrBackslashes; j++) {
+                sb.append('\\');
+            }
+
+            if (i < end) {
+                sb.append(input.charAt(i));
+            }
+        }
+        return CMD_METACHARS.matcher(sb).replaceAll("^$0");
+    }
+
+    @Override
+    @Nonnull String surroundWithQuotes(@Nonnull String input) {
+        return '"' + input + '"';
+    }
+
+    @Override
+    @Nonnull String getUnquotedForm(@Nonnull String input) {
+        return QUOTED_CHARS.matcher(input).replaceAll("$2");
+    }
+}