From b687aff45105014f8ebdfe92fc750fad88e3aac8 Mon Sep 17 00:00:00 2001
From: ai-anant <ant2010in@gmail.com>
Date: Fri, 14 Aug 2026 21:53:11 +0000
Subject: [PATCH] feat(java): detect secret-typed jelly fields rendered with
 f:textbox instead of f:password (CWE-522)

---
 java/jenkins/views/secret-field-textbox.yaml | 31 ++++++++++++++++++++
 1 file changed, 31 insertions(+)
 create mode 100644 java/jenkins/views/secret-field-textbox.yaml

diff --git a/java/jenkins/views/secret-field-textbox.yaml b/java/jenkins/views/secret-field-textbox.yaml
new file mode 100644
index 0000000..bcfe184
--- /dev/null
+++ b/java/jenkins/views/secret-field-textbox.yaml
@@ -0,0 +1,31 @@
+rules:
+  - id: codevigilant.java.jenkins.views.secret-field-textbox
+    patterns:
+      - pattern: |
+          <f:entry field="$FIELD">
+            <f:textbox />
+          </f:entry>
+      - metavariable-regex:
+          metavariable: $FIELD
+          regex: (?i).*(api.?key|secret|token|passwd|password|credential).*
+    message: |
+      Detected a Jenkins config view (jelly) that renders a secret-typed field
+      with f:textbox instead of f:password. Secret values (API keys, tokens,
+      passwords) must use f:password so the value is not echoed into the
+      rendered config page, browser history or page source and so changes
+      require an explicit re-entry. Rendering the value in a plain textbox
+      exposes the credential to anyone able to view the page and can leak it
+      through backups, screenshots or client-side artifacts.
+    metadata:
+      category: security
+      cwe: "CWE-522: Insufficiently Protected Credentials"
+      owasp: "A07:2021 - Identification and Authentication Failures"
+      technology: jenkins
+      confidence: MEDIUM
+      references:
+        - https://www.jenkins.io/doc/developer/security/
+      source: independent security review
+      license: MIT
+    languages: [xml]
+    mode: search
+    severity: WARNING