[JENKINS-73499] Add a warning if there is a risk of exposing credentials through a non-TLS proxy connection

core/src/main/java/hudson/ProxyConfiguration.java

@@ -540,6 +540,34 @@ public FormValidation doCheckPort(@QueryParameter String value) {
             return FormValidation.ok();
         }
 
+        /**
+         * Do check if the provided value is empty or composed of whitespaces.
+         * If so, return a validation warning.
+         *
+         * @param value the value to test
+         * @return a validation warning iff the provided value is empty or composed of whitespaces.
+         */
+        private static FormValidation checkProxyCredentials(String value) {
+            value = Util.fixEmptyAndTrim(value);
+            if (value == null) {
+                return FormValidation.ok();
+            } else {
+                return FormValidation.warning(Messages.ProxyConfiguration_NonTLSWarning());
+            }
+        }
+
+        @RequirePOST
+        @Restricted(NoExternalUse.class)
+        public FormValidation doCheckUserName(@QueryParameter String value) {
+            return checkProxyCredentials(value);
+        }
+
+        @RequirePOST
+        @Restricted(NoExternalUse.class)
+        public FormValidation doCheckSecretPassword(@QueryParameter String value) {
+            return checkProxyCredentials(value);
+        }
+
         @RequirePOST
         @Restricted(NoExternalUse.class)
         public FormValidation doValidateProxy(

core/src/main/resources/hudson/Messages.properties

@@ -110,6 +110,7 @@ ProxyConfiguration.TestUrlRequired=Test URL is required.
 ProxyConfiguration.MalformedTestUrl=Malformed Test URL {0}.
 ProxyConfiguration.FailedToConnectViaProxy=Failed to connect to {0}.
 ProxyConfiguration.FailedToConnect=Failed to connect to {0} (code {1}).
+ProxyConfiguration.NonTLSWarning=Please note that the connection between Jenkins and the proxy is always via an HTTP connection. Therefore, this insecure connection may expose the credentials provided.
 ProxyConfiguration.Success=Success (code {0})
 
 Functions.NoExceptionDetails=No Exception details

core/src/main/resources/hudson/Messages_es.properties

@@ -99,6 +99,7 @@ ProxyConfiguration.TestUrlRequired=Se requiere un URL de prueba.
 ProxyConfiguration.MalformedTestUrl=La URL de prueba está mal formada.
 ProxyConfiguration.FailedToConnectViaProxy=No se puede conectar a {0}.
 ProxyConfiguration.FailedToConnect=No se puede conectar a {0} (código {1}).
+ProxyConfiguration.NonTLSWarning=Tenga en cuenta que la conexión entre Jenkins y el proxy es siempre usando una conexión HTTP y por tanto esta conexión insegura puede exponer las credenciales introducidas.
 ProxyConfiguration.Success=Configurado (código {0})
 
 Functions.NoExceptionDetails=No hay detalles de la excepción

core/src/main/resources/hudson/Messages_fr.properties

@@ -109,6 +109,7 @@ ProxyConfiguration.TestUrlRequired=Une URL de test est requise.
 ProxyConfiguration.MalformedTestUrl=L''URL de test {0} n''est pas correctement formée.
 ProxyConfiguration.FailedToConnectViaProxy=Impossible de se connecter à {0}.
 ProxyConfiguration.FailedToConnect=Impossible de se connecter à {0} (code {1}).
+ProxyConfiguration.NonTLSWarning=Veuillez noter que la connexion entre Jenkins et le proxy se fait toujours via une connexion HTTP. Par conséquent, cette connexion non sécurisée peut exposer les informations d''identification fournies.
 ProxyConfiguration.Success=Succès (code {0})
 
 Functions.NoExceptionDetails=Aucun détail concernant l''exception

core/src/main/resources/hudson/Messages_it.properties

@@ -106,6 +106,7 @@ PluginWrapper.PluginWrapperAdministrativeMonitor.DisplayName=Errore \
 ProxyConfiguration.FailedToConnect=Impossibile connettersi a {0} (codice {1}).
 ProxyConfiguration.FailedToConnectViaProxy=Impossibile connettersi a {0}.
 ProxyConfiguration.MalformedTestUrl=URL di prova {0} malformato.
+ProxyConfiguration.NonTLSWarning=Si prega di notare che la connessione tra Jenkins e il proxy avviene sempre tramite una connessione HTTP. Pertanto, questa connessione non sicura potrebbe esporre le credenziali fornite.
 ProxyConfiguration.Success=Connessione riuscita (codice {0})
 ProxyConfiguration.TestUrlRequired=È richiesto un URL di prova.
 TcpSlaveAgentListener.PingAgentProtocol.displayName=Protocollo ping