bitbucket-branch-source-plugin icon indicating copy to clipboard operation
bitbucket-branch-source-plugin copied to clipboard

[JENKINS-73471] Restore passing credentialsId to the GitSCM

Open Dohbedoh opened this issue 1 year ago • 10 comments

Proposal to fix https://github.com/jenkinsci/bitbucket-branch-source-plugin/issues/862. Reinstore the credentialsId in the GitSCM configuration. It would also guarantee that credentials usage is still tracked. Checking down the line, GitClient still uses the authenticator credentials reference.

@yaroslavafenkin Per my understanding, the issue that SECURITY-3363 fixes was the clone link of the OAuth Authenticator at https://github.com/jenkinsci/bitbucket-branch-source-plugin/blob/886.v44cf5e4ecec5/src/main/java/com/cloudbees/jenkins/plugins/bitbucket/api/credentials/BitbucketOAuthAuthenticator.java#L48-L57 ? In which case instantiating the GitSCM with the credentialsId is fine ? I am not sure what is the scenario to validate that this does not bring back this security problem ?

Your checklist for this pull request

  • [x] Make sure you are requesting to pull a topic/feature/bugfix branch (right side) and not your master branch!
  • [x] Ensure that the pull request title represents the desired changelog entry
  • [x] Please describe what you did
  • [x] Link to relevant issues in GitHub or in Jenkins JIRA
  • [x] Link to relevant pull requests, esp. upstream and downstream changes
  • [ ] Did you provide a test-case? That demonstrates feature works or fixes the issue.

Dohbedoh avatar Aug 01 '24 01:08 Dohbedoh