[JENKINS-63254][JENKINS-47101] Insecure Groovy String Interpolation Warnings

src/main/java/org/jenkinsci/plugins/workflow/cps/DSL.java

@@ -425,9 +425,10 @@ protected Object invokeDescribable(String symbol, Object _args) {
         StepDescriptor metaStep = metaSteps.size()==1 ? metaSteps.get(0) : null;
 
         boolean singleArgumentOnly = false;
+        DescribableModel<?> symbolModel = null;
         if (metaStep != null) {
             Descriptor symbolDescriptor = SymbolLookup.get().findDescriptor((Class)(metaStep.getMetaStepArgumentType()), symbol);
-            DescribableModel<?> symbolModel = DescribableModel.of(symbolDescriptor.clazz);
+            symbolModel = DescribableModel.of(symbolDescriptor.clazz);
 
             singleArgumentOnly = symbolModel.hasSingleRequiredParameter() && symbolModel.getParameters().size() == 1;
         }
@@ -436,6 +437,7 @@ protected Object invokeDescribable(String symbol, Object _args) {
         NamedArgsAndClosure args = parseArgs(_args, metaStep!=null && metaStep.takesImplicitBlockArgument(),
                 UninstantiatedDescribable.ANONYMOUS_KEY, singleArgumentOnly, new HashSet<>());
         UninstantiatedDescribable ud = new UninstantiatedDescribable(symbol, null, args.namedArgs);
+        ud.setModel(symbolModel);
 
         if (metaStep==null) {
             // there's no meta-step associated with it, so this symbol is not executable.

src/main/java/org/jenkinsci/plugins/workflow/cps/view/InterpolatedSecretsAction.java

@@ -25,10 +25,14 @@
 
 import hudson.model.Run;
 import jenkins.model.RunAction2;
+import org.jenkinsci.plugins.structs.describable.DescribableModel;
+import org.jenkinsci.plugins.structs.describable.DescribableParameter;
 import org.jenkinsci.plugins.structs.describable.UninstantiatedDescribable;
 import org.jenkinsci.plugins.workflow.actions.ArgumentsAction;
 import org.jenkinsci.plugins.workflow.flow.FlowExecutionOwner;
 import org.jenkinsci.plugins.workflow.graph.FlowNode;
+import org.jenkinsci.plugins.workflow.graph.StepNode;
+import org.jenkinsci.plugins.workflow.steps.StepDescriptor;
 import org.kohsuke.accmod.Restricted;
 import org.kohsuke.accmod.restrictions.NoExternalUse;
 import org.kohsuke.stapler.export.Exported;
@@ -117,32 +121,48 @@ public static class InterpolatedWarnings {
         @Exported
         public String getStepSignature() {
             Map<String, Object> stepArguments;
+            FlowNode node;
             try {
-                stepArguments = getStepArguments(run, nodeId);
+                node = getFlowNode(run, nodeId);
+                ArgumentsAction argumentsAction = node.getPersistentAction(ArgumentsAction.class);
+                if (argumentsAction == null) {
+                    throw new IllegalStateException("null arguments action");
+                }
+                stepArguments = argumentsAction.getArguments();
             } catch (IllegalStateException e) {
                 return "Unable to construct " +  stepName + ": " + e.getMessage();
             }
 
+            if (node instanceof StepNode) {
+                StepDescriptor descriptor = ((StepNode)node).getDescriptor();
+                if (descriptor != null && descriptor.isMetaStep()) {
+                    DescribableParameter p = DescribableModel.of(descriptor.clazz).getFirstRequiredParameter();
+                    if (p != null) {
+                        Object arg = ArgumentsAction.getResolvedArguments(node).get(p.getName());
+                        if (arg instanceof UninstantiatedDescribable) {
+                            return argumentToString(arg);
+                        } else {
+                            return stepName + "(" + argumentToString(arg) + ")";
+                        }
+                    }
+                }
+            }
+
             return stepArguments.entrySet().stream()
                     .map(InterpolatedSecretsAction::argumentToString)
                     .collect(Collectors.joining(", ", stepName + "(", ")"));
         }
 
         @Nonnull
-        private Map<String, Object> getStepArguments(Run run, String nodeId) throws IllegalStateException {
+        private FlowNode getFlowNode(Run run, String nodeId) {
             String failReason;
             if (run instanceof FlowExecutionOwner.Executable) {
                 try {
                     FlowExecutionOwner owner = ((FlowExecutionOwner.Executable) run).asFlowExecutionOwner();
                     if (owner != null) {
                         FlowNode node = owner.get().getNode(nodeId);
                         if (node != null) {
-                            ArgumentsAction argumentsAction = node.getPersistentAction(ArgumentsAction.class);
-                            if (argumentsAction != null) {
-                                return argumentsAction.getArguments();
-                            } else {
-                                failReason = "null arguments action";
-                            }
+                            return node;
                         } else {
                             failReason = "null flow node";
                         }
@@ -162,7 +182,6 @@ private Map<String, Object> getStepArguments(Run run, String nodeId) throws Ille
         public List<String> getInterpolatedVariables() {
             return interpolatedVariables;
         }
-
     }
 
     private static String argumentToString(Object arg) {
@@ -200,9 +219,14 @@ private static String argumentToString(Object arg) {
             UninstantiatedDescribable ud = (UninstantiatedDescribable) arg;
             Map<String, ?> udArgs = ud.getArguments();
             if (ud.getSymbol() != null) {
-                valueString = udArgs.entrySet().stream()
-                        .map(InterpolatedSecretsAction::argumentToString)
-                        .collect(Collectors.joining(", ", ud.getSymbol() + "(", ")"));
+                String prefix = ud.getSymbol() + "(";
+                if (ud.hasSoleRequiredArgument() && udArgs.size() == 1) {
+                    valueString = prefix + argumentToString(udArgs.values().iterator().next()) + ")";
+                } else {
+                    valueString = udArgs.entrySet().stream()
+                            .map(InterpolatedSecretsAction::argumentToString)
+                            .collect(Collectors.joining(", ", prefix, ")"));
+                }
             } else {
                 if (udArgs.isEmpty()) {
                     valueString = "[$class: " + ud.getKlass() + "]";

src/test/java/org/jenkinsci/plugins/workflow/cps/DSLTest.java

@@ -485,7 +485,7 @@ public void namedSoleParamForStep() throws Exception {
         List<InterpolatedSecretsAction.InterpolatedWarnings> warnings = reportAction.getWarnings();
         MatcherAssert.assertThat(warnings.size(), is(1));
         InterpolatedSecretsAction.InterpolatedWarnings stepWarning = warnings.get(0);
-        MatcherAssert.assertThat(stepWarning.getStepSignature(), is("archiveArtifacts(delegate: archiveArtifacts(<anonymous>: ${PASSWORD}))"));
+        MatcherAssert.assertThat(stepWarning.getStepSignature(), is("archiveArtifacts(${PASSWORD})"));
         MatcherAssert.assertThat(stepWarning.getInterpolatedVariables(), is(Arrays.asList("PASSWORD")));
     }