Last weekend we updated the Jenkins instance (2.249.3) and now every build in the pipeline gives a lot of warnings:
"The following steps that have been detected may have insecure interpolation of sensitive variables".
We use a Jenkinsfile to configure the pipeline steps, with a lot of property parameters, among which 2 password type fields. All warnings suggest that those 2 password type fields are passed to either a echo or a sh command. But this seems not to be true.
The first warning in the log shows after creating the 2 password type parameters. After this, every echo or sh command which uses string interpolation throws a warning in the log regarding those 2 fields, even though these specific fields are not used in that command:
[2020-11-20T10:24:44.032Z] [Pipeline] properties
[2020-11-20T10:24:44.037Z] Warning: A secret was passed to "properties" using Groovy String interpolation, which is insecure.
[2020-11-20T10:24:44.037Z] Affected argument(s) used the following variable(s): [PASSWORD_PROD, PASSWORD]
[2020-11-20T10:24:44.037Z] See https://jenkins.io/redirect/groovy-string-interpolation for details.
[2020-11-20T10:24:46.435Z] [Pipeline] echo
[2020-11-20T10:24:46.436Z] Warning: A secret was passed to "echo" using Groovy String interpolation, which is insecure.
[2020-11-20T10:24:46.436Z] Affected argument(s) used the following variable(s): [PASSWORD_PROD, PASSWORD]
[2020-11-20T10:24:46.436Z] See https://jenkins.io/redirect/groovy-string-interpolation for details.
The last warning is triggered by this echo:
echo "${COLOR_INFO}[INFO] ${messageText}${COLOR_END}"
The 2 password fields are not used in string interpolation. Other parameters are, but we don't mind showing those in the log.
Is this some kind of bug in the last update? Or are we doing something wrong indeed?