Merge pull request #378 from Kevin-CB/JENKINS-75914

[JENKINS-75914] Do not mask empty secrets

Author: jtnord

src/main/java/org/jenkinsci/plugins/credentialsbinding/impl/BindingStep.java

@@ -163,6 +163,9 @@ private static final class Handler implements FailureHandler {
             @NonNull
             @Override
             public Throwable handle(@NonNull StepContext ctx, @NonNull Throwable t) {
+                if (Secret.toString(secretPattern).isEmpty()) {
+                    return t;
+                }
                 return MaskedException.of(t, Pattern.compile(secretPattern.getPlainText()));
             }
         }

src/test/java/org/jenkinsci/plugins/credentialsbinding/impl/BindingStepTest.java

@@ -550,6 +550,23 @@ public void usernameUnmaskedInStepArguments() throws Throwable {
         });
     }
 
+    @Issue("JENKINS-75914")
+    @Test public void emptyOrBlankCredsOnExceptions() throws Throwable {
+        rr.then(r -> {
+            CredentialsProvider.lookupStores(r.jenkins).iterator().next().addCredentials(Domain.global(), new StringCredentialsImpl(CredentialsScope.GLOBAL, "creds", "sample", Secret.fromString("")));
+            var p = r.jenkins.createProject(WorkflowJob.class, "p");
+            p.setDefinition(new CpsFlowDefinition(
+                    """
+                            withCredentials([string(credentialsId: 'creds', variable: 'SECRET')]) {
+                                error(/random String/)
+                            }
+                            """, true));
+            var b = r.buildAndAssertStatus(Result.FAILURE, p);
+            r.assertLogNotContains("****", b);
+            r.assertLogContains("random String", b);
+        });
+    }
+
     private void assertErrorActionsDoNotContainString(WorkflowRun b, String needle) {
         var errorActionStackTraces = new DepthFirstScanner().allNodes(b.getExecution()).stream()
                 .map(n -> n.getPersistentAction(ErrorAction.class))