Fix description environment variable security issue.

src/main/java/hudson/plugins/descriptionsetter/DescriptionSetterBuilder.java

@@ -24,19 +24,21 @@ public class DescriptionSetterBuilder extends Builder {
     private final String regexp;
     private final String description;
     private final boolean appendMode;
+    private final boolean envVariable;
 
     @DataBoundConstructor
-    public DescriptionSetterBuilder(String regexp, String description, boolean appendMode) {
+    public DescriptionSetterBuilder(String regexp, String description, boolean appendMode, boolean envVariable) {
         this.regexp = regexp;
         this.description = Util.fixEmptyAndTrim(description);
         this.appendMode = appendMode;
+        this.envVariable = envVariable;
     }
 
     @Override
     public boolean perform(AbstractBuild<?, ?> build, Launcher launcher, BuildListener listener)
             throws InterruptedException {
 
-        return DescriptionSetterHelper.setDescription(build, listener, regexp, description, appendMode);
+        return DescriptionSetterHelper.setDescription(build, listener, regexp, description, appendMode, envVariable);
     }
 
     @Extension

src/main/java/hudson/plugins/descriptionsetter/DescriptionSetterHelper.java

@@ -39,7 +39,7 @@
     public static boolean setDescription(
             AbstractBuild<?, ?> build, BuildListener listener, String regexp, String description)
             throws InterruptedException {
-        return setDescription(build, listener, regexp, description, true);
+        return setDescription(build, listener, regexp, description, true, true);
     }
 
     /**
@@ -51,12 +51,19 @@
      * @param regexp the regular expression to apply to the build log.
      * @param description the description to set.
      * @param appendMode if true, description is added to the current one
+     * @param envVariable if true, environment variable containing the
+     *         description is set.
      * @return true, regardless of if the regular expression matched and a
      *         description could be set or not.
      * @throws InterruptedException if the build is interrupted by the user.
      */
     public static boolean setDescription(
-            AbstractBuild<?, ?> build, BuildListener listener, String regexp, String description, boolean appendMode)
+            AbstractBuild<?, ?> build,
+            BuildListener listener,
+            String regexp,
+            String description,
+            boolean appendMode,
+            boolean envVariable)
             throws InterruptedException {
         try {
             String result = null;
@@ -87,7 +94,9 @@
             if (build.getDescription() == null) build.setDescription(result);
             else build.setDescription((appendMode ? build.getDescription() + htmlBreak : "") + result);
 
-            setEnvironmentVariable(result, build);
+            if (envVariable) {
+                setEnvironmentVariable(result, build);
+            }
 
             listener.getLogger().println(LOG_PREFIX + " Description set: " + result);
         } catch (IOException e) {

src/main/java/hudson/plugins/descriptionsetter/DescriptionSetterPublisher.java

@@ -38,6 +38,7 @@
     private final String descriptionForFailed;
     private final boolean setForMatrix;
     private final boolean appendMode;
+    private final boolean envVariable;
 
     @Deprecated
     private transient boolean setForFailed = false;
@@ -52,13 +53,15 @@
             String description,
             String descriptionForFailed,
             boolean setForMatrix,
-            boolean appendMode) {
+            boolean appendMode,
+            boolean envVariable) {
         this.regexp = regexp;
         this.regexpForFailed = regexpForFailed;
         this.description = Util.fixEmptyAndTrim(description);
         this.descriptionForFailed = Util.fixEmptyAndTrim(descriptionForFailed);
         this.setForMatrix = setForMatrix;
         this.appendMode = appendMode;
+        this.envVariable = envVariable;
     }
 
     public BuildStepMonitor getRequiredMonitorService() {
@@ -78,13 +81,14 @@
                 listener,
                 useUnstable ? regexpForFailed : regexp,
                 useUnstable ? descriptionForFailed : description,
-                appendMode);
+                appendMode,
+                envVariable);
     }
 
     private Object readResolve() throws ObjectStreamException {
         if (explicitNotRegexp) {
             return new DescriptionSetterPublisher(
-                    null, null, regexp, setForFailed ? regexpForFailed : null, false, false);
+                    null, null, regexp, setForFailed ? regexpForFailed : null, false, false, true);
         } else {
             return this;
         }

src/main/resources/hudson/plugins/descriptionsetter/DescriptionSetterBuilder/config.jelly

@@ -10,4 +10,7 @@
 	<f:entry title="${%Append to description instead of resetting it}" field="appendMode">
 		<f:checkbox />
 	</f:entry>
+	<f:entry title="${%Add Environment Variable}" field="envVariable">
+		<f:checkbox default="true" />
+	</f:entry>
 </j:jelly>

src/main/resources/hudson/plugins/descriptionsetter/DescriptionSetterBuilder/help.html

@@ -6,6 +6,6 @@
 	A description can be based on the log output (by searching it using a regular expression), or it can be hardcoded.
 	</p>
 	<p>
-	The description is exposed as DESCRIPTION_SETTER_DESCRIPTION environment variable
+	Optionally, the description is exposed as DESCRIPTION_SETTER_DESCRIPTION environment variable (considered insecure on Jenkins 2)
 	</p>
 </div>

src/main/resources/hudson/plugins/descriptionsetter/DescriptionSetterPublisher/config.jelly

@@ -22,6 +22,9 @@
 		<f:entry title="${%Append to description instead of resetting it}" field="appendMode">
 			<f:checkbox />
 		</f:entry>
+		<f:entry title="${%Add Environment Variable}" field="envVariable">
+			<f:checkbox default="true" />
+		</f:entry>
 	</f:advanced>
 
 </j:jelly>

src/main/resources/hudson/plugins/descriptionsetter/DescriptionSetterPublisher/help.html

@@ -6,6 +6,6 @@
 	A description can be based on the log output (by searching it using a regular expression), or it can be hardcoded.
 	</p>
 	<p>
-	The description is exposed as DESCRIPTION_SETTER_DESCRIPTION environment variable
+	Optionally, the description is exposed as DESCRIPTION_SETTER_DESCRIPTION environment variable (considered insecure on Jenkins 2)
 	</p>
 </div>

src/test/java/hudson/plugins/descriptionsetter/DescriptionSetterBuilderTest.java

@@ -56,8 +56,8 @@ public void testNullMatch2() throws Exception {
 
     public void testAppendDescriptionInBuilder() throws Exception {
         FreeStyleProject project = createFreeStyleProject();
-        project.getBuildersList().add(new DescriptionSetterBuilder("", "test1", false));
-        project.getBuildersList().add(new DescriptionSetterBuilder("", "test2", true));
+        project.getBuildersList().add(new DescriptionSetterBuilder("", "test1", false, true));
+        project.getBuildersList().add(new DescriptionSetterBuilder("", "test2", true, true));
         FreeStyleBuild build = project.scheduleBuild2(0).get();
         assertEquals("test1 test2", build.getDescription());
 
@@ -69,8 +69,8 @@ public void testAppendDescriptionInBuilder() throws Exception {
 
     public void testRewriteDescriptionInBuilder() throws Exception {
         FreeStyleProject project = createFreeStyleProject();
-        project.getBuildersList().add(new DescriptionSetterBuilder("", "test1", false));
-        project.getBuildersList().add(new DescriptionSetterBuilder("", "test2", false));
+        project.getBuildersList().add(new DescriptionSetterBuilder("", "test1", false, true));
+        project.getBuildersList().add(new DescriptionSetterBuilder("", "test2", false, true));
         FreeStyleBuild build = project.scheduleBuild2(0).get();
         assertEquals("test2", build.getDescription());
     }
@@ -79,7 +79,7 @@ private String getDescription(String text, Result result, String regexp, String
             throws Exception {
         FreeStyleProject project = createFreeStyleProject();
         project.getBuildersList().add(new TestBuilder(text, result));
-        project.getBuildersList().add(new DescriptionSetterBuilder(regexp, description, appendMode));
+        project.getBuildersList().add(new DescriptionSetterBuilder(regexp, description, appendMode, true));
         FreeStyleBuild build = project.scheduleBuild2(0).get();
         return build.getDescription();
     }

src/test/java/hudson/plugins/descriptionsetter/DescriptionSetterPublisherTest.java

@@ -83,8 +83,8 @@ public void testNullMatch2() throws Exception {
 
     public void testAppendDescriptionInPublisher() throws Exception {
         FreeStyleProject project = createFreeStyleProject();
-        project.getBuildersList().add(new DescriptionSetterBuilder("", "test1", false));
-        project.getPublishersList().add(new DescriptionSetterPublisher("", "", "test2", "", false, true));
+        project.getBuildersList().add(new DescriptionSetterBuilder("", "test1", false, true));
+        project.getPublishersList().add(new DescriptionSetterPublisher("", "", "test2", "", false, true, true));
         FreeStyleBuild build = project.scheduleBuild2(0).get();
         assertEquals("test1 test2", build.getDescription());
 
@@ -96,8 +96,8 @@ public void testAppendDescriptionInPublisher() throws Exception {
 
     public void testRewriteDescriptionInPublisher() throws Exception {
         FreeStyleProject project = createFreeStyleProject();
-        project.getBuildersList().add(new DescriptionSetterBuilder("", "test1", false));
-        project.getPublishersList().add(new DescriptionSetterPublisher("", "", "test2", "", false, false));
+        project.getBuildersList().add(new DescriptionSetterBuilder("", "test1", false, true));
+        project.getPublishersList().add(new DescriptionSetterPublisher("", "", "test2", "", false, false, true));
         FreeStyleBuild build = project.scheduleBuild2(0).get();
         assertEquals("test2", build.getDescription());
     }
@@ -115,7 +115,7 @@ private String getDescription(
         project.getBuildersList().add(new TestBuilder(text, result));
         project.getPublishersList()
                 .add(new DescriptionSetterPublisher(
-                        regexp, regexpForFailed, description, descriptionForFailed, false, appendMode));
+                        regexp, regexpForFailed, description, descriptionForFailed, false, appendMode, true));
         FreeStyleBuild build = project.scheduleBuild2(0).get();
         return build.getDescription();
     }