[MRELEASE-937] Git password is visible if commit fails

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: 2.5.2, 2.5.3
• Component/s: Git
• Labels: security
• Assignee: Robert Scholte
• Reporter: vishal sahasrabuddhe
• Created: 04/Jan/16 08:30
• Updated: 04/Jan/16 20:34
• Resolved: 04/Jan/16 20:34

Description

Git username and password is being visible during perform section when plugin tries to commit the file using SCM section repository.

Here is the log.

[INFO] Checking in modified POMs...
[INFO] Executing: /bin/sh -c cd /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing && git add -- pom.xml
[INFO] Working directory: /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing
[INFO] Executing: /bin/sh -c cd /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing && git rev-parse --show-toplevel
[INFO] Working directory: /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing
[INFO] Executing: /bin/sh -c cd /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing && git status --porcelain .
[INFO] Working directory: /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing
[WARNING] Ignoring unrecognized line: ?? pom.xml.releaseBackup
[WARNING] Ignoring unrecognized line: ?? release.properties
[WARNING] Ignoring unrecognized line: ?? target/
[INFO] Executing: /bin/sh -c cd /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing && git commit --verbose -F /tmp/maven-scm-859671901.commit pom.xml
[INFO] Working directory: /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing
[INFO] Executing: /bin/sh -c cd /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing && git symbolic-ref HEAD
[INFO] Working directory: /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing
[INFO] Executing: /bin/sh -c cd /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing && git push https://releasebot:********@gitlab.something.com/sandbox/data-ingestion-dco.git refs/heads/master:refs/heads/master
[INFO] Working directory: /home/releasebot/workspace/data-ingestion-dcos_Release_builder_testing
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 8.856 s (Wall Clock)
[INFO] Finished at: 2016-01-04T08:15:04+00:00
[INFO] Final Memory: 17M/484M
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-release-plugin:2.5.3:prepare (default-cli) on project qubole_python: Unable to commit files
[ERROR] Provider message:
[ERROR] The git-push command failed.
[ERROR] Command output:
[ERROR] remote: Not Found
[ERROR] fatal: repository 'https://releasebot:abc@[e-mail]/sandbox/data-ingestion-dco.git/' not found
[ERROR] -> [Help 1]
[ERROR] 
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR] 
[ERROR] For more information about the errors and possible solutions, please read the following articles:

So, i can see password "abc@123" here.

I am using maven Apache Maven 3.3.9
tried with maven release plugin 2.5.3 and 2.5.2 both but no luck.

Issue Links

• duplicates: MRELEASE-928 exposing the password for SCM URL if build failed to commit files to SCM