JENKINS-60373: Read secret from file and encode it with base64

Feature Request

I am looking for a way to practically and securely inject binary secrets from /run/secret into a file credential type (plain-credentials plugin). The challenge is, the input is expected to be base64 encoded so reading the file as-is from /run/secrets does not work. Extending plain-credentials to read the file content instead of expecting inlined string is something that was proven challenging to secure. Several approaches to address that was discussed in JENKINS-60373 and I would like to propose the most straightforward one[1].

---

Introduce a new syntax, that would permit reading file from filesystem and encoding the content with base64 to close the gap between traditional secrets injection and file credential. The reasoning is that when the feature is specific for JCasC, it is by definition restricted to administrators eliminating possible arbitrary file read vulnerabilities.

[1] https://issues.jenkins-ci.org/browse/JENKINS-60373?focusedCommentId=381101&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-381101

[jetersen]

@jglick @olivergondza @timja Switching to apache’s StringSubstitutor would enable this Though the default lookup might be too powerful for JCasC use case.

Though it will cleanup some of the code as StringSubstitutor already supports default value via :- Also supports nested variable substitution. So you could have something like

${base64:${file:${/run/secrets/whatever}}}

Default String Lookups
Key	Implementation	Factory Method	Since
"base64Decoder"	Base64DecoderStringLookup	base64DecoderStringLookup()	1.6
"base64Encoder"	Base64EncoderStringLookup	base64EncoderStringLookup()	1.6
"const"	ConstantStringLookup	constantStringLookup()	1.5
"date"	DateStringLookup	dateStringLookup()	1.5
"dns"	DnsStringLookup	dnsStringLookup()	1.8
"env"	EnvironmentVariableStringLookup	environmentVariableStringLookup()	1.3
"file"	FileStringLookup	fileStringLookup()	1.5
"java"	JavaPlatformStringLookup	javaPlatformStringLookup()	1.5
"localhost"	LocalHostStringLookup	localHostStringLookup()	1.3
"properties"	PropertiesStringLookup	propertiesStringLookup()	1.5
"resourceBundle"	ResourceBundleStringLookup	resourceBundleStringLookup()	1.6
"script"	ScriptStringLookup	scriptStringLookup()	1.5
"sys"	SystemPropertyStringLookup	systemPropertyStringLookup()	1.3
"url"	UrlStringLookup	urlStringLookup()	1.5
"urlDecoder"	UrlDecoderStringLookup	urlDecoderStringLookup()	1.5
"urlEncoder"	UrlEncoderStringLookup	urlEncoderStringLookup()	1.5
"xml"	XmlStringLookup	xmlStringLookup()	1.5

I would properly settle for:

"base64" Base64EncoderStringLookup
"file" FileStringLookup

[jetersen]

Ah I would need to use different BenchmarkMode lucky there are annotations for that.