-
Bug
-
Resolution: Fixed
-
Low
-
5.9.1, 5.10.3
-
None
-
None
Summary
Password masking in logs outputs a lot of asterisks if any of the password variable contain an asterisk and there is more than 1 password variable.
Steps to Reproduce
- Create 2 variables with password in it's name:
- password1 = 123
- password2 = *
- Add a script task that does any command, example echo "Hello"
- Run the plan
Expected Results
In the build logs, it should show:
password1=********
password2=********
Actual Results
For each password Bamboo would show 512 asterisks
Extent
If you have multiple variables that contain passwords of just asterisks, the number of asterisks will increase by 8 exponent. If there is 10 variables containing just asterisks, Bamboo will create 1 billion asterisks for each password variable in the logs.
Workaround
For Bamboo 5.10.3. This patched jar will prevent the cascading effect of the password masking.
- Stop Bamboo
- Backup <bamboo install dir>/atlassian-bamboo/WEB-INF/lib/atlassian-bamboo-api-5.10.3.jar to a separate directory
- Place this file in the above directory atlassian-bamboo-api-5.10.3.jar
- Start Bamboo
- is a regression of
-
BAM-14475 Password variables must be masked in the build log
- Closed
| Form Name | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
[BAM-17488] Password masking in logs outputs a lot of asterisks if any of the password variable contain an asterisk
dlee@atlassian.com - thanks for the confirmation. I've been hoping you might also be able to resolve the issue in case?
Thing is, we are getting support requests for issues like this one, which we are referring to in issues and knowledge base articles in turn (see e.g. UAA-168), leading to conflicting/confusing information. Accordingly, it would help a lot if all resolved issues get, well, resolved 
- thanks much! /cc mgardias
sopel1, Yes, this has been fixed with 5.12. In my 5.12.3.1 test, the issue is no longer present.
dlee@atlassian.com - has this fix actually been released with 5.12.0?
Yes, I would also like if these fixes would be included in release notes, we are now still running 5.10.3 with custom `atlassian-bamboo-api-5.10.3.jar`..., having read both 5.11 and 5.12 release notes and they don't Include any information about this fix.