[JENKINS-63254][JENKINS-47101] Insecure Groovy String Interpolation Warnings

src/main/java/org/jenkinsci/plugins/workflow/cps/DSL.java

@@ -223,7 +223,7 @@ protected Object invokeStep(StepDescriptor d, String name, Object args) {
         // TODO: generalize the notion of Step taking over the FlowNode creation.
         boolean hack = d instanceof ParallelStep.DescriptorImpl || d instanceof LoadStep.DescriptorImpl;
 
-        FlowNode an = null;
+        FlowNode an;
         CpsThread thread = CpsThread.current();
         if (!d.takesImplicitBlockArgument() && !hack) {
             an = new StepAtomNode(exec, d, thread.head.get());
@@ -232,7 +232,7 @@ protected Object invokeStep(StepDescriptor d, String name, Object args) {
         }
 
         CpsStepContext context = new CpsStepContext(d, thread, handle, an);
-        EnvironmentWatcher envWatcher = new EnvironmentWatcher(context);
+        EnvironmentWatcher envWatcher = EnvironmentWatcher.of(context, exec);
         NamedArgsAndClosure ps = parseArgs(args, d, envWatcher);
         context.setBody(ps.body, thread);
         // Ensure ArgumentsAction is attached before we notify even synchronous listeners:
@@ -271,7 +271,9 @@ protected Object invokeStep(StepDescriptor d, String name, Object args) {
                 DescribableModel<? extends Step> stepModel = DescribableModel.of(d.clazz);
                 s = stepModel.instantiate(ps.namedArgs, listener);
             }
-            envWatcher.logResults(listener);
+            if (envWatcher != null) {
+                envWatcher.logResults(listener);
+            }
 
             // Persist the node - block start and end nodes do their own persistence.
             CpsFlowExecution.maybeAutoPersistNode(an);
@@ -466,7 +468,7 @@ private NamedArgsAndClosure(Map<?,?> namedArgs, Closure body, @Nullable Environm
 
             for (Map.Entry<?,?> entry : namedArgs.entrySet()) {
                 String k = entry.getKey().toString().intern(); // coerces GString and more
-                Object v = flattenGString(entry.getValue(), envWatcher);//expander, msgs);//envVars, msgs);
+                Object v = flattenGString(entry.getValue(), envWatcher);
                 this.namedArgs.put(k, v);
             }
         }

src/main/java/org/jenkinsci/plugins/workflow/cps/EnvironmentWatcher.java

@@ -1,12 +1,14 @@
 package org.jenkinsci.plugins.workflow.cps;
 
 import hudson.EnvVars;
+import hudson.model.Run;
 import hudson.model.TaskListener;
+import org.jenkinsci.plugins.workflow.cps.view.EnvironmentWatcherRunReport;
+import org.jenkinsci.plugins.workflow.flow.FlowExecutionOwner;
 import org.jenkinsci.plugins.workflow.steps.EnvironmentExpander;
 
-import javax.annotation.CheckForNull;
+import javax.annotation.Nonnull;
 import java.io.IOException;
-import java.io.PrintStream;
 import java.io.Serializable;
 import java.util.List;
 import java.util.Set;
@@ -15,39 +17,49 @@
 import java.util.stream.Collectors;
 
 public class EnvironmentWatcher implements Serializable {
-    private EnvVars envVars = null;
-    private EnvironmentExpander expander = null;
+    private EnvVars envVars;
     private Set<String> watchedVars;
     private List<String> scanResults;
+    private static EnvironmentWatcherRunReport runReport;
 
     private static final Logger LOGGER = Logger.getLogger(EnvironmentWatcher.class.getName());
 
-    public EnvironmentWatcher(CpsStepContext context) {
+    public static EnvironmentWatcher of(CpsStepContext context, CpsFlowExecution exec) {
         try {
-            envVars = context.get(EnvVars.class);
-            expander = context.get(EnvironmentExpander.class);
-        } catch (IOException | InterruptedException e) {
-            e.printStackTrace();
-        } catch (IllegalArgumentException e) {
-            LOGGER.log(Level.WARNING, "Error storing the arguments for step: " + context.getStepDescriptor().getFunctionName(), e);
-        }
-        if (expander != null) {
-            watchedVars = expander.getSensitiveVars();
+            EnvVars contextEnvVars = context.get(EnvVars.class);
+            EnvironmentExpander contextExpander = context.get(EnvironmentExpander.class);
+            if (contextEnvVars != null && contextExpander != null) {
+                if (runReport == null) {
+                    FlowExecutionOwner owner = exec.getOwner();
+                    if (owner != null && owner.getExecutable() instanceof Run) {
+                        runReport = ((Run) owner.getExecutable()).getAction(EnvironmentWatcherRunReport.class);
+                    }
+                }
+                if (runReport != null) {
+                    return new EnvironmentWatcher(contextEnvVars, contextExpander);
+                }
+            }
+        } catch (InterruptedException | IOException e) {
+            LOGGER.log(Level.FINE, "Unable to create EnvironmentWatcher instance.\n" + e.getMessage());
         }
+        return null;
+    }
+
+    public EnvironmentWatcher(@Nonnull EnvVars envVars, @Nonnull EnvironmentExpander expander) {
+        this.envVars = envVars;
+        watchedVars = expander.getSensitiveVars();
     }
 
     public void scan(String text) {
-        // TODO: would EnvVars ever be null?
-        if (watchedVars == null || envVars == null) {
-            scanResults = null;
-        } else {
-            scanResults = watchedVars.stream().filter(e -> text.contains(envVars.get(e))).collect(Collectors.toList());
-        }
+        scanResults = watchedVars.stream().filter(e -> text.contains(envVars.get(e))).collect(Collectors.toList());
     }
 
     public void logResults(TaskListener listener) {
         if (scanResults != null && !scanResults.isEmpty()) {
             listener.getLogger().println("The following Groovy string may be insecure. Use single quotes to prevent leaking secrets via Groovy interpolation. Affected variables: "  + scanResults.toString());
+            runReport.record(scanResults);
         }
     }
+
+    private static final long serialVersionUID = 1L;
 }

src/main/java/org/jenkinsci/plugins/workflow/cps/view/EnvironmentWatcherListener.java

@@ -0,0 +1,31 @@
+package org.jenkinsci.plugins.workflow.cps.view;
+
+import hudson.Extension;
+import hudson.model.Run;
+import org.jenkinsci.plugins.workflow.flow.FlowExecution;
+import org.jenkinsci.plugins.workflow.flow.FlowExecutionListener;
+import org.jenkinsci.plugins.workflow.flow.FlowExecutionOwner;
+
+import javax.annotation.Nonnull;
+import java.io.IOException;
+import java.util.logging.Logger;
+
+/**
+ * Listener to add action for UI report for each run
+ */
+@Extension
+public class EnvironmentWatcherListener extends FlowExecutionListener {
+    private static final Logger LOGGER = Logger.getLogger(EnvironmentWatcherListener.class.getName());
+
+    @Override
+    public void onRunning(@Nonnull FlowExecution execution) {
+        FlowExecutionOwner owner = execution.getOwner();
+        try {
+            if (owner != null && owner.getExecutable() instanceof Run) {
+                ((Run) owner.getExecutable()).addAction(new EnvironmentWatcherRunReport());
+            }
+        } catch (IOException e) {
+            LOGGER.warning(e.getMessage());
+        }
+    }
+}

src/main/java/org/jenkinsci/plugins/workflow/cps/view/EnvironmentWatcherRunReport.java

@@ -0,0 +1,56 @@
+package org.jenkinsci.plugins.workflow.cps.view;
+
+import hudson.model.Run;
+import jenkins.model.RunAction2;
+import java.io.Serializable;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+/**
+ * Action to generate the UI report for watched environment variables
+ */
+public class EnvironmentWatcherRunReport implements RunAction2, Serializable {
+
+    private Set<String> results;
+    private transient Run<?, ?> run;
+
+    public String getIconFileName() {
+        return null;
+    }
+
+    public String getDisplayName() {
+        return null;
+    }
+
+    public String getUrlName() {
+        return null;
+    }
+
+    public void record(List<String> stepResults) {
+        if (results == null) {
+            results = new HashSet<>();
+        }
+        results.addAll(stepResults);
+    }
+
+    public Set<String> getResults() {
+        return results;
+    }
+
+    public boolean getInProgress() {
+        return run.isBuilding();
+    }
+
+    @Override
+    public void onAttached(Run<?, ?> run) {
+        this.run = run;
+    }
+
+    @Override
+    public void onLoad(Run<?, ?> run) {
+        this.run = run;
+    }
+
+    private static final long serialVersionUID = 1L;
+}

src/main/resources/org/jenkinsci/plugins/workflow/cps/view/EnvironmentWatcherRunReport/summary.jelly

@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+The MIT License
+Copyright (c) 2020, CloudBees, Inc.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:t="/lib/hudson">
+    <t:summary icon="warning.png">
+        Possible insecure use of sensitive variables:
+        <j:if test="${it.inProgress}">
+            (in progress)
+        </j:if>
+        <ul>
+            <j:forEach var="variable" items="${it.results}">
+                <li>${variable}</li>
+            </j:forEach>
+        </ul>
+    </t:summary>
+</j:jelly>