feat(java): detect secret-typed Jenkins jelly fields rendered with f:textbox (CWE-522)

java/jenkins/views/secret-field-textbox.yaml

@@ -0,0 +1,31 @@
+rules:
+  - id: codevigilant.java.jenkins.views.secret-field-textbox
+    patterns:
+      - pattern: |
+          <f:entry field="$FIELD">
+            <f:textbox />
+          </f:entry>
+      - metavariable-regex:
+          metavariable: $FIELD
+          regex: (?i).*(api.?key|secret|token|passwd|password|credential).*
+    message: |
+      Detected a Jenkins config view (jelly) that renders a secret-typed field
+      with f:textbox instead of f:password. Secret values (API keys, tokens,
+      passwords) must use f:password so the value is not echoed into the
+      rendered config page, browser history or page source and so changes
+      require an explicit re-entry. Rendering the value in a plain textbox
+      exposes the credential to anyone able to view the page and can leak it
+      through backups, screenshots or client-side artifacts.
+    metadata:
+      category: security
+      cwe: "CWE-522: Insufficiently Protected Credentials"
+      owasp: "A07:2021 - Identification and Authentication Failures"
+      technology: jenkins
+      confidence: MEDIUM
+      references:
+        - https://www.jenkins.io/doc/developer/security/
+      source: independent security review
+      license: MIT
+    languages: [xml]
+    mode: search
+    severity: WARNING