[JENKINS-59246] Password with cyrillic symbols and numbers not masked

[jenkins-infra-bot]

Hello,

I have pipeline job with maven release plugin configured.

Username and password are provided as String Parameter & Password Parameter respectively, password is configured to be masked.

When latin symbols and digits are used in password, it is masked correctly. E.g. in log, we see:

mvn release:prepare release:perform -B -U -DreleaseVersion=1.2.3 -Dusername=<myusername> -Dpassword=********

If password contains any cyrillic symbols and digits, the following is shown in build log:

mvn release:prepare release:perform -B -U -DreleaseVersion=111.111.111 -Dusername=<myusername> -Dpassword=latin?????????123456

Here, the actual password string was "latinКириллица123456"

Also, when release-plugin fails, it shows errors like this:

fatal: Authentication failed for 'https://<login>:<pass>@<repoUrl>'

So for latin & digits password, the is shown masked as ******, but for both latin, cyrillic & digits, it becomes like this:

89%3F%3F%3F123456

and one can see unmasked part of the password in this URL.

Could you please fix it?

 

---

Originally reported by prifiz, imported from: Password with cyrillic symbols and numbers not masked

• status: Open
• priority: Major
• component(s): mask-passwords-plugin
• resolution: Unresolved
• votes: 0
• watchers: 1
• imported: 20251216-225446

Raw content of original issue

Hello,

I have pipeline job with maven release plugin configured.

Username and password are provided as String Parameter & Password Parameter respectively, password is configured to be masked.

When latin symbols and digits are used in password, it is masked correctly. E.g. in log, we see:

mvn release:prepare release:perform -B -U -DreleaseVersion=1.2.3 -Dusername=<myusername> -Dpassword=********

If password contains any cyrillic symbols and digits, the following is shown in build log:

mvn release:prepare release:perform -B -U -DreleaseVersion=111.111.111 -Dusername=<myusername> -Dpassword=latin?????????123456


Here, the actual password string was "latinКириллица123456"
Also, when release-plugin fails, it shows errors like this:

fatal: Authentication failed for 'https://<login>:<pass>@<repoUrl>'

So for latin & digits password, the <pass> is shown masked as ******, but for both latin, cyrillic & digits, it becomes like this:

89%3F%3F%3F123456

and one can see unmasked part of the password in this URL.
Could you please fix it?
 

[jenkins-infra-bot]

prifiz:

• Original comment link
• Raw content of original comment:

  Is there any news about this issue?
  

Is there any news about this issue?