[SECURITY-3451]

core/src/main/resources/lib/form/secretTextarea.jelly

@@ -101,7 +101,7 @@ Example usage:
         </div>
         <div class="secret-input">
             <textarea id="${id}" hidden="hidden" name="${name}" placeholder="${placeholder}"
-                      class="${attrs.checkUrl!=null?' jenkins-input validated':''}"
+                      class="secretTextarea-redact ${attrs.checkUrl!=null?' jenkins-input validated':''}"
                       checkUrl="${attrs.checkUrl}" checkDependsOn="${attrs.checkDependsOn}" checkMethod="${attrs.checkMethod}">
                 <st:out value="${value}" />
             </textarea>

test/src/test/java/jenkins/security/RedactSecretJsonInErrorMessageSanitizerHtmlTest.java

@@ -31,19 +31,24 @@
 import static org.hamcrest.Matchers.hasItem;
 import static org.hamcrest.Matchers.not;
 
+import hudson.ExtensionList;
 import hudson.model.Describable;
 import hudson.model.Descriptor;
 import hudson.model.RootAction;
 import hudson.util.Secret;
 import java.io.PrintWriter;
 import java.io.StringWriter;
 import java.util.logging.Level;
+import javax.servlet.ServletException;
 import jenkins.model.Jenkins;
 import net.sf.json.JSONObject;
 import org.htmlunit.Page;
+import org.htmlunit.html.HtmlElement;
+import org.htmlunit.html.HtmlElementUtil;
 import org.htmlunit.html.HtmlForm;
 import org.htmlunit.html.HtmlInput;
 import org.htmlunit.html.HtmlPage;
+import org.htmlunit.html.HtmlTextArea;
 import org.junit.Rule;
 import org.junit.Test;
 import org.jvnet.hudson.test.Issue;
@@ -223,6 +228,81 @@ public void checkSanitizationIsApplied_inStapler() throws Exception {
         ));
     }
 
+    @Test
+    @Issue("SECURITY-3451")
+    public void secretTextAreaSubmissionRedaction() throws Exception {
+        final TestSecretTextarea action = ExtensionList.lookupSingleton(TestSecretTextarea.class);
+
+        logging.record("", Level.WARNING).capture(100);
+
+        final String secretValue = "s3cr3t";
+
+        try (JenkinsRule.WebClient wc = j.createWebClient().withThrowExceptionOnFailingStatusCode(false)) {
+
+            HtmlPage page = wc.goTo("test");
+
+            final HtmlForm form = page.getFormByName("config");
+            final HtmlElement button = form.getElementsByTagName("button").stream().filter(b -> HtmlElementUtil.hasClassName(b, "secret-update-btn")).findFirst().orElseThrow();
+            HtmlElementUtil.click(button);
+
+            ((HtmlTextArea) form.getElementsByTagName("textarea").stream().filter(field -> HtmlElementUtil.hasClassName(field, "secretTextarea-redact")).findFirst().orElseThrow()).setText(secretValue);
+
+            Page formSubmitPage = j.submit(form);
+            assertThat(formSubmitPage.getWebResponse().getContentAsString(), allOf(
+                    containsString(RedactSecretJsonInErrorMessageSanitizer.REDACT_VALUE),
+                    not(containsString(secretValue))
+            ));
+        }
+
+        // check the system log also
+        Throwable thrown = logging.getRecords().stream().filter(r -> r.getMessage().contains("Error while serving")).findAny().get().getThrown();
+        // the exception from RequestImpl
+        assertThat(thrown.getCause().getMessage(), allOf(
+                containsString(RedactSecretJsonInErrorMessageSanitizer.REDACT_VALUE),
+                not(containsString(secretValue))
+        ));
+
+        StringWriter buffer = new StringWriter();
+        thrown.printStackTrace(new PrintWriter(buffer));
+        String fullStack = buffer.getBuffer().toString();
+        assertThat(fullStack, allOf(
+                containsString(RedactSecretJsonInErrorMessageSanitizer.REDACT_VALUE),
+                not(containsString(secretValue))
+        ));
+    }
+
+    public static class SecretTextareaDescribable {
+        @DataBoundConstructor
+        public SecretTextareaDescribable(Secret secret) {
+            throw new IllegalArgumentException("there is something wrong with the secret");
+        }
+    }
+
+    @TestExtension("secretTextAreaSubmissionRedaction")
+    public static class TestSecretTextarea implements RootAction {
+
+        public JSONObject lastJsonReceived;
+
+        public void doSubmitTest(StaplerRequest req) throws ServletException {
+            req.bindJSON(SecretTextareaDescribable.class, req.getSubmittedForm());
+        }
+
+        @Override
+        public String getIconFileName() {
+            return null;
+        }
+
+        @Override
+        public String getDisplayName() {
+            return null;
+        }
+
+        @Override
+        public String getUrlName() {
+            return "test";
+        }
+    }
+
     public static class TestDescribable implements Describable<TestDescribable> {
 
         @DataBoundConstructor

test/src/test/resources/jenkins/security/RedactSecretJsonInErrorMessageSanitizerHtmlTest/TestSecretTextarea/index.jelly

@@ -0,0 +1,39 @@
+<!--
+The MIT License
+
+Copyright (c) 2024 CloudBees, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+-->
+<?jelly escape-by-default='true'?>
+<j:jelly xmlns:j="jelly:core" xmlns:l="/lib/layout" xmlns:f="/lib/form">
+    <l:layout title="Making sure the secret is redacted from error messages">
+        <l:main-panel>
+            <f:form method="post" name="config" action="submitTest">
+                <f:entry>
+                    <f:secretTextarea field="secret" placeholder="placeholder" />
+                </f:entry>
+
+                <f:bottomButtonBar>
+                    <f:submit value="submit"/>
+                </f:bottomButtonBar>
+            </f:form>
+        </l:main-panel>
+    </l:layout>
+</j:jelly>

war/src/main/webapp/scripts/hudson-behavior.js

@@ -2582,6 +2582,9 @@ function buildFormTree(form) {
           if (e.classList.contains("complex-password-field")) {
             addProperty(p, "$redact", shortenName(e.name));
           }
+          if (e.classList.contains("secretTextarea-redact")) {
+            addProperty(p, "$redact", shortenName(e.name));
+          }
           break;
       }
     }