Variables expansion in the payload

[lisotton]

Jenkins and plugins versions report

In one of my jobs I have this with credentials:

credentialsBinding {
  string('BOT_TOKEN', 'bot-token')
  usernamePassword('OTHER_CREDENTIALS', 'other-credentials')
}

Then I have this with Generic Webhook Trigger:

genericVariable {
  key("COMMENT_TEXT")
  value("\$.comment.text")
}

If in the comment text I have something like:

Use the variable ${BOT_TOKEN} and ${OTHER_CREDENTIALS}.

Then inside of the shell command I have

echo "${COMMENT_TEXT}"

The output will be:

Use the variable **** and ****.

I have this job working as a webhook for Bitbucket, so when someone adds a comment to a PR a message is sent in Mattermost to the user. Then the person will receive not the ***, they are receiving the actual credentials, but they were supposed to receive the literal Use the variable ${BOT_TOKEN} and ${OTHER_CREDENTIALS}..

I believe the plugin is doing the expansion or I'm missing some configuration.

[tomasbjerre]

I can confirm this. Perhaps easier to reproduce with some default environment variable like:

node {
 properties([
  pipelineTriggers([
   [$class: 'GenericTrigger',
    genericVariables: [
     [key: 'ref', value: '$.ref']
    ],

    token: 'abc123',
    printContributedVariables: true,
    printPostContent: true,
   ]
  ])
 ])

 stage("build") {
  sh '''
  echo Variables from shell:
  echo ref $ref
  '''
 }
}

I trigger it with:

curl -v  -H "Content-Type: application/json"  -X POST  -d '{ "ref": "JOB_NAME:${JOB_NAME}"}'  "http://localhost:8080/jenkins/generic-webhook-trigger/invoke?token=abc123"

And the build log will show "pipe" being resolved as the JOB_NAME from the variable in the curl command:

Generic Cause
[Pipeline] Start of Pipeline
 Received:

{ "ref": "JOB_NAME:${JOB_NAME}"}


Contributing variables:

    ref = JOB_NAME:${JOB_NAME}


[Pipeline] node
Running on [Jenkins](http://localhost:8080/jenkins/computer/(built-in)/) in /home/bjerre/workspace/generic-webhook-trigger-plugin/work/workspace/pipe
[Pipeline] {
[Pipeline] properties
[Pipeline] stage
[Pipeline] { (build)
[Pipeline] sh
+ echo Variables from shell:
Variables from shell:
+ echo ref JOB_NAME:pipe
ref JOB_NAME:pipe

The plugin contributes the value here:

generic-webhook-trigger-plugin/src/main/java/org/jenkinsci/plugins/gwt/GenericWebhookEnvironmentContributor.java

Line 41 in 2f3fa48

envs.override(variable, resolved);

It is not expanded when the plugin contributes it. At that point it is still JOB_NAME:${JOB_NAME}.

I think Jenkins Core reads it here and expands variables inside each variable:
https://github.com/jenkinsci/jenkins/blob/a5a61cd8e011c3dc90ff34e47cc85af6cf8e5349/core/src/main/java/hudson/tasks/CommandInterpreter.java#L128
https://github.com/jenkinsci/jenkins/blob/a5a61cd8e011c3dc90ff34e47cc85af6cf8e5349/core/src/main/java/hudson/model/AbstractBuild.java#L976
https://github.com/jenkinsci/jenkins/blob/a5a61cd8e011c3dc90ff34e47cc85af6cf8e5349/core/src/main/java/hudson/EnvVars.java#L361
https://github.com/jenkinsci/jenkins/blob/a5a61cd8e011c3dc90ff34e47cc85af6cf8e5349/core/src/main/java/hudson/Util.java#L191

And I don't really know how that can be solved. I don't see any other way of doing it in EnvVars.

I'll see if someone can help on this...

[jglick]

CommandInterpreter and AbstractBuild are not involved in a Pipeline build, FYI.

[bpedersen2]

I think there is some confusion over where which expansion happens. You need to also ensure no shell expansion happens, so in your input string you need to quote the $.

[tomasbjerre]

I think there is some confusion over where which expansion happens. You need to also ensure no shell expansion happens, so in your input string you need to quote the $.

If I add println "printout from groovy: " + ref to the pipeline, it will printout: printout from groovy: JOB_NAME:pipe. That tells me it is not an issue with shell expansion in the plugin, or the user code.

I think this is an issue with Jenkins and the EnvVars API. The value I put, is not the value I get. Perhaps it needs a new method that lets users contribute values exactly "as is" and not do any expansion.