Package io.jenkins.plugins.configsplice

Class ResolvedValue

java.lang.Object
io.jenkins.plugins.configsplice.ResolvedValue
All Implemented Interfaces:
Serializable
public final class ResolvedValue extends Object implements Serializable
A replacement value in flight, carried so that accidental string conversion cannot expose it.

Gate 2 measured two things that force this type to exist (ADR-003):

  • Secret.toString() returns the plaintext, so "value=" + secret leaks. The rule "never log a value" cannot be enforced by using Secret as the carrying type.
  • Secret does not encrypt under Java serialization, so this offers no wire protection either. It is not trying to: confidentiality over remoting rests on the channel's transport security and on the agent being trusted.

What this type does buy is that the plaintext is reachable only through plainText(), a name that is conspicuous in review and impossible to reach by accident. Literals are wrapped too, not just credentials, so there is exactly one path through the code and no "is this the safe one?" judgement at each call site.

See Also:

  • Method Details

    • literal

      public static ResolvedValue literal(@NonNull String literal)
      A literal supplied in the Pipeline script. Wrapped identically to a credential.

    • credential

      public static ResolvedValue credential(@NonNull Secret secret)
      A value resolved from a Secret Text credential.

    • plainText

      public String plainText()
      The plaintext.

      Every call is a place a secret could escape. Callers must pass the result straight to serialisation or comparison and must never place it in a message, log line or exception.

    • fromCredential

      public boolean fromCredential()
      True when this came from a credential, which drives the security notice and type rules.

    • toString

      public String toString()
      Overrides:
      toString in class Object