CVE-2019-10286

@@ -0,0 +1,14 @@
+#release configuration
+#Wed Apr 03 17:15:36 MDT 2019
+scm.tagNameFormat=@{project.artifactId}-@{project.version}
+scm.username=sbtaylor15
+pushChanges=true
+scm.url=scm\:git\:https\://github.com/jenkinsci/deployhub-plugin.git
+preparationGoals=clean install
+scm.password=G0p\!1966
+remoteTagging=true
+projectVersionPolicyId=default
+scm.commentPrefix=[maven-release-plugin] 
+exec.snapshotReleasePluginAllowed=false
+exec.additionalArguments=
+completedPhase=check-poms

@@ -8,10 +8,10 @@
 import java.io.InputStreamReader;
 import java.net.HttpURLConnection;
 import java.net.URL;
+import java.net.URLEncoder;
 import java.nio.charset.StandardCharsets;
 import java.util.HashMap;
 import java.util.List;
-import java.net.URLEncoder;
 
 import javax.xml.parsers.DocumentBuilder;
 // for XML parsing

@@ -1,10 +1,11 @@
 package org.jenkinsci.plugins.deployhub;
 
-import hudson.Extension;
-import java.util.HashMap;
 import java.util.ArrayList;
+import java.util.HashMap;
+
 import org.kohsuke.stapler.bind.JavaScriptMethod;
 
+import hudson.Extension;
 import hudson.model.Action;
 
 @Extension

@@ -4,7 +4,6 @@
 import java.io.BufferedWriter;
 import java.io.File;
 import java.io.FileOutputStream;
-import java.io.FileWriter;
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.OutputStreamWriter;
@@ -44,6 +43,7 @@
 import hudson.tasks.Publisher;
 import hudson.tasks.Recorder;
 import hudson.util.FormValidation;
+import hudson.util.Secret;
 
 public class DeployHub extends Recorder {
 
@@ -72,7 +72,7 @@ public static class DescriptorImpl extends Descriptor<Attribute> {
 	private boolean debug=false;
 
 	private final String username;
-	private final String password;
+	private final Secret password;
 	private boolean deployApplication;
 	private boolean useAdvanced;
 	private boolean findLatestVersion;
@@ -119,7 +119,7 @@ public DeployHub(	String username,
 			List<Attribute> compatts)
 	{
 		this.username = username;
-		this.password = password;
+		this.password = Secret.fromString(password);
 		this.deployApplication = deployApplication;
 		this.useAdvanced = useAdvanced;
 		this.findLatestVersion = findLatestVersion;
@@ -149,7 +149,7 @@ public String getUsername() {
 	}
 
 	public String getPassword() {
-		return password;
+		return Secret.toString(password);
 	}
 
 	public boolean getDeployApplication() {
@@ -327,7 +327,7 @@ public boolean perform(AbstractBuild<?, ?> build, Launcher launcher, BuildListen
 			//
 			String urlstr = server + "/dmadminweb/API/login"
 			+"?user="+URLEncoder.encode(username, "UTF-8")
-			+"&pass="+URLEncoder.encode(password, "UTF-8");
+			+"&pass="+URLEncoder.encode(Secret.toString(password), "UTF-8");
 			//listener.getLogger().println("DEBUG: urlstr="+urlstr);
 			JsonObject res = SendMessage(listener,cm,urlstr);
 			//listener.getLogger().println("JSON Result = "+res.toString());

@@ -4,8 +4,6 @@
 import hudson.ExtensionPoint;
 import hudson.model.Action;
 import hudson.model.Describable;
-
-
 import jenkins.model.Jenkins;
 
 public abstract class DeployHubMenu implements ExtensionPoint, Action, Describable<DeployHubMenu> {

@@ -1,12 +1,14 @@
 package org.jenkinsci.plugins.deployhub;
 
+import java.util.List;
+
+import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerResponse;
+
 import hudson.Extension;
-import hudson.model.RootAction;
 import hudson.model.Action;
+import hudson.model.RootAction;
 import jenkins.model.ModelObjectWithContextMenu;
-import org.kohsuke.stapler.StaplerRequest;
-import org.kohsuke.stapler.StaplerResponse;
-import java.util.List;
 
 /**
  * Entry point to all the UI samples.