CVE-2022-39309 (published 2022-10-14T20:15Z)

GoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. GoCD versions prior to 21.1.0 leak the symmetric key used to encrypt/decrypt any secure variables/secrets in GoCD configuration to authenticated agents. A malicious/compromised agent may then expose that key from memory, and potentially allow an attacker the ability to decrypt secrets intended for other agents/environments if they also are able to obtain access to encrypted configuration values from the GoCD server. This issue is fixed in GoCD version 21.1.0. There are currently no known workarounds.

CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-668
cwe_name: Exposure of Resource to Wrong Sphere
description: The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
extended_description: 
            Resources such as files and directories may be inadvertently exposed through mechanisms such as insecure permissions, or when a program accidentally operates on the wrong object. For example, a program may intend that private files can only be provided to a specific user. This effectively defines a control sphere that is intended to prevent attackers from accessing these private files. If the file permissions are insecure, then parties other than the user will be able to access those files.
            A separate control sphere might effectively require that the user can only access the private files, but not any other files on the system. If the program does not ensure that the user is only requesting private files, then the user might be able to access other files on the system.
            In either case, the end result is that a resource has been exposed to the wrong party.
         
         

Fix information:
repo_url: https://github.com/gocd/gocd
commit_details: repo_url: https://github.com/gocd/gocd
author: Mahesh Panchaksharaiah
author_date: 2020-12-08 11:35:51+05:30
msg: SCMMaterial changes #000

* SCMMaterial unlike SCMMaterialConfig objects are used for polling,
  they do not need to encrypt the password. Hence removing the
  encryptedPassword attribute.
repository: repo_url: https://github.com/gocd/gocd
repo_name: gocd/gocd
description: GoCD - Continuous Delivery server main repository
repo_language: Java
owner: gocd
file_changes: filename: MaintenanceModeInfoRepresenterTest.groovy
change_type: ModificationType.MODIFY
diff: @@ -134,7 +134,7 @@ class MaintenanceModeInfoRepresenterTest {
                 "auto_update"       : true,
                 "check_externals"   : true,
                 "username"          : "user",
-                "encrypted_password": svnMaterial.encryptedPassword
+                "encrypted_password": svnMaterial.config().getEncryptedPassword()
               ],
               "mdu_start_time": "1970-01-01T08:20:00Z"
             ]

programming_language: Scala
filename: P4MaterialTest.java
change_type: ModificationType.MODIFY
diff: @@ -97,31 +97,6 @@ public class P4MaterialTest extends P4MaterialTestBase {
         assertThat(p4.toString()).doesNotContain("loser");
     }
 
-    @Test
-    void shouldEncryptP4Password() throws Exception {
-        GoCipher mockGoCipher = mock(GoCipher.class);
-        when(mockGoCipher.encrypt("password")).thenReturn("encrypted");
-
-        P4Material p4Material = new P4Material("example.com:1818", "view", mockGoCipher);
-        p4Material.setPassword("password");
-        p4Material.ensureEncrypted();
-
-        assertThat(p4Material.getEncryptedPassword()).isEqualTo("encrypted");
-        assertThat(p4Material.getPassword()).isNull();
-    }
-
-    @Test
-    void shouldDecryptP4Password() throws Exception {
-        GoCipher mockGoCipher = mock(GoCipher.class);
-        when(mockGoCipher.decrypt("encrypted")).thenReturn("password");
-
-        P4Material p4Material = new P4Material("example.com:1818", "view", mockGoCipher);
-        ReflectionUtil.setField(p4Material, "encryptedPassword", "encrypted");
-        p4Material.getPassword();
-
-        assertThat(p4Material.getPassword()).isEqualTo("password");
-    }
-
     @Test
     void shouldReturnEqualsEvenIfPasswordsAreDifferent() throws Exception {
         P4Material material = MaterialsMother.p4Material();

programming_language: Java
filename: TfsMaterialTest.java
change_type: ModificationType.MODIFY
diff: @@ -68,8 +68,8 @@ public class TfsMaterialTest {
     @BeforeEach
     void setUp() {
         GoCipher goCipher = mock(GoCipher.class);
-        tfsMaterialFirstCollectionFirstProject = new TfsMaterial(goCipher, new UrlArgument(TFS_FIRST_COLLECTION_URL), USERNAME, DOMAIN, PASSWORD, TFS_FIRST_PROJECT);
-        tfsMaterialFirstCollectionSecondProject = new TfsMaterial(goCipher, new UrlArgument(TFS_FIRST_COLLECTION_URL), USERNAME, DOMAIN, PASSWORD, TFS_SECOND_PROJECT);
+        tfsMaterialFirstCollectionFirstProject = new TfsMaterial(new UrlArgument(TFS_FIRST_COLLECTION_URL), USERNAME, DOMAIN, PASSWORD, TFS_FIRST_PROJECT);
+        tfsMaterialFirstCollectionSecondProject = new TfsMaterial(new UrlArgument(TFS_FIRST_COLLECTION_URL), USERNAME, DOMAIN, PASSWORD, TFS_SECOND_PROJECT);
     }
 
     @Test
@@ -104,7 +104,7 @@ public class TfsMaterialTest {
 
     @Test
     void shouldInjectAllRelevantAttributesInSqlCriteriaMap() {
-        TfsMaterial tfsMaterial = new TfsMaterial(new GoCipher(), new UrlArgument("my-url"), "loser", DOMAIN, "foo_bar_baz", "/dev/null");
+        TfsMaterial tfsMaterial = new TfsMaterial(new UrlArgument("my-url"), "loser", DOMAIN, "foo_bar_baz", "/dev/null");
         assertThat(tfsMaterial.getSqlCriteria()).isEqualTo(m(
                 SQL_CRITERIA_TYPE, (Object) "TfsMaterial",
                 "url", "my-url",
@@ -114,7 +114,7 @@ public class TfsMaterialTest {
 
     @Test
     void shouldInjectAllRelevantAttributesInAttributeMap() {
-        TfsMaterial tfsMaterial = new TfsMaterial(new GoCipher(), new UrlArgument("my-url"), "loser", DOMAIN, "foo_bar_baz", "/dev/null");
+        TfsMaterial tfsMaterial = new TfsMaterial(new UrlArgument("my-url"), "loser", DOMAIN, "foo_bar_baz", "/dev/null");
         assertThat(tfsMaterial.getAttributesForXml()).isEqualTo(m(
                 AbstractMaterial.SQL_CRITERIA_TYPE, (Object) "TfsMaterial",
                 "url", "my-url",
@@ -124,56 +124,31 @@ public class TfsMaterialTest {
 
     @Test
     void shouldReturnUrlForCommandLine_asUrl_IfSet() {
-        TfsMaterial tfsMaterial = new TfsMaterial(new GoCipher(), new UrlArgument("http://foo:bar@my-url.com"), "loser", DOMAIN, "foo_bar_baz", "/dev/null"
+        TfsMaterial tfsMaterial = new TfsMaterial(new UrlArgument("http://foo:bar@my-url.com"), "loser", DOMAIN, "foo_bar_baz", "/dev/null"
         );
         assertThat(tfsMaterial.getUrl()).isEqualTo("http://foo:bar@my-url.com");
 
-        tfsMaterial = new TfsMaterial(new GoCipher(), null, "loser", DOMAIN, "foo_bar_baz", "/dev/null");
+        tfsMaterial = new TfsMaterial(null, "loser", DOMAIN, "foo_bar_baz", "/dev/null");
         assertThat(tfsMaterial.getUrl()).isNull();
     }
 
     @Test
     void shouldReturnUrlForCommandLine_asLocation_IfSet() {
-        TfsMaterial tfsMaterial = new TfsMaterial(new GoCipher(), new UrlArgument("http://foo:bar@my-url.com"), "loser", DOMAIN, "foo_bar_baz", "/dev/null"
+        TfsMaterial tfsMaterial = new TfsMaterial(new UrlArgument("http://foo:bar@my-url.com"), "loser", DOMAIN, "foo_bar_baz", "/dev/null"
         );
         assertThat(tfsMaterial.getLocation()).isEqualTo("http://foo:******@my-url.com");
 
-        tfsMaterial = new TfsMaterial(new GoCipher(), null, "loser", DOMAIN, "foo_bar_baz", "/dev/null");
+        tfsMaterial = new TfsMaterial(null, "loser", DOMAIN, "foo_bar_baz", "/dev/null");
         assertThat(tfsMaterial.getLocation()).isNull();
     }
 
-    @Test
-    void shouldEncryptTfsPasswordAndMarkPasswordAsNull() throws Exception {
-        GoCipher mockGoCipher = mock(GoCipher.class);
-        when(mockGoCipher.encrypt("password")).thenReturn("encrypted");
-
-        TfsMaterial tfsMaterial = new TfsMaterial(mockGoCipher, new UrlArgument("/foo"), "username", DOMAIN, "password", "");
-        tfsMaterial.ensureEncrypted();
-
-        assertThat(tfsMaterial.getPassword()).isNull();
-        assertThat(tfsMaterial.getEncryptedPassword()).isEqualTo("encrypted");
-    }
-
-    @Test
-    void shouldDecryptTfsPassword() throws Exception {
-        GoCipher mockGoCipher = mock(GoCipher.class);
-        when(mockGoCipher.decrypt("encrypted")).thenReturn("password");
-
-        TfsMaterial tfsMaterial = new TfsMaterial(mockGoCipher, new UrlArgument("/foo"), "username", DOMAIN, null, "");
-
-        ReflectionUtil.setField(tfsMaterial, "encryptedPassword", "encrypted");
-
-        tfsMaterial.ensureEncrypted();
-        assertThat(tfsMaterial.getPassword()).isEqualTo("password");
-    }
-
     @Test
     void shouldNotDecryptPasswordIfPasswordIsNotNull() throws Exception {
         GoCipher mockGoCipher = mock(GoCipher.class);
         when(mockGoCipher.encrypt("password")).thenReturn("encrypted");
         when(mockGoCipher.decrypt("encrypted")).thenReturn("password");
 
-        TfsMaterial material = new TfsMaterial(mockGoCipher, new UrlArgument("/foo"), "username", DOMAIN, "password", "");
+        TfsMaterial material = new TfsMaterial(new UrlArgument("/foo"), "username", DOMAIN, "password", "");
         material.ensureEncrypted();
         when(mockGoCipher.encrypt("new_password")).thenReturn("new_encrypted");
         material.setPassword("new_password");
@@ -182,33 +157,6 @@ public class TfsMaterialTest {
         assertThat(material.getPassword()).isEqualTo("new_password");
     }
 
-    @Test
-    void shouldErrorOutIfDecryptionFails() throws CryptoException {
-        GoCipher mockGoCipher = mock(GoCipher.class);
-        String fakeCipherText = "fake cipher text";
-        when(mockGoCipher.decrypt(fakeCipherText)).thenThrow(new CryptoException("exception"));
-        TfsMaterial material = new TfsMaterial(mockGoCipher, new UrlArgument("/foo"), "username", DOMAIN, "password", "");
-        ReflectionUtil.setField(material, "encryptedPassword", fakeCipherText);
-        try {
-            material.getPassword();
-            fail("Should have thrown up");
-        } catch (Exception e) {
-            assertThat(e.getMessage()).isEqualTo("Could not decrypt the password to get the real password");
-        }
-    }
-
-    @Test
-    void shouldErrorOutIfEncryptionFails() throws Exception {
-        GoCipher mockGoCipher = mock(GoCipher.class);
-        when(mockGoCipher.encrypt("password")).thenThrow(new CryptoException("exception"));
-        try {
-            new TfsMaterial(mockGoCipher, new UrlArgument("/foo"), "username", DOMAIN, "password", "");
-            fail("Should have thrown up");
-        } catch (Exception e) {
-            assertThat(e.getMessage()).isEqualTo("Password encryption failed. Please verify your cipher key.");
-        }
-    }
-
     @Test
     void shouldBePasswordAware() {
         assertThat(PasswordAwareMaterial.class.isAssignableFrom(TfsMaterial.class)).isTrue();
@@ -237,13 +185,13 @@ public class TfsMaterialTest {
 
     @Test
     void shouldGetLongDescriptionForMaterial() {
-        TfsMaterial material = new TfsMaterial(new GoCipher(), new UrlArgument("http://url/"), "user", "domain", "password", "$project/path/");
+        TfsMaterial material = new TfsMaterial(new UrlArgument("http://url/"), "user", "domain", "password", "$project/path/");
         assertThat(material.getLongDescription()).isEqualTo("URL: http://url/, Username: user, Domain: domain, ProjectPath: $project/path/");
     }
 
     @Test
     void shouldCopyOverPasswordWhenConvertingToConfig() throws Exception {
-        TfsMaterial material = new TfsMaterial(new GoCipher(), new UrlArgument("http://url/"), "user", "domain", "password", "$project/path/");
+        TfsMaterial material = new TfsMaterial(new UrlArgument("http://url/"), "user", "domain", "password", "$project/path/");
 
         TfsMaterialConfig config = (TfsMaterialConfig) material.config();
 
@@ -253,7 +201,7 @@ public class TfsMaterialTest {
 
     @Test
     void shouldGetAttributesWithSecureFields() {
-        TfsMaterial material = new TfsMaterial(new GoCipher(), new UrlArgument("http://username:password@tfsrepo.com"), "username", "domain", "password", "$project/path/");
+        TfsMaterial material = new TfsMaterial(new UrlArgument("http://username:password@tfsrepo.com"), "username", "domain", "password", "$project/path/");
         Map<String, Object> attributes = material.getAttributes(true);
 
         assertThat(attributes.get("type")).isEqualTo("tfs");
@@ -267,7 +215,7 @@ public class TfsMaterialTest {
 
     @Test
     void shouldGetAttributesWithoutSecureFields() {
-        TfsMaterial material = new TfsMaterial(new GoCipher(), new UrlArgument("http://username:password@tfsrepo.com"), "username", "domain", "password", "$project/path/");
+        TfsMaterial material = new TfsMaterial(new UrlArgument("http://username:password@tfsrepo.com"), "username", "domain", "password", "$project/path/");
         Map<String, Object> attributes = material.getAttributes(false);
 
         assertThat(attributes.get("type")).isEqualTo("tfs");
@@ -283,14 +231,14 @@ public class TfsMaterialTest {
     class passwordForCommandLine {
         @Test
         void shouldReturnPasswordAsConfigured_IfNotDefinedAsSecretParam() {
-            TfsMaterial tfsMaterial = new TfsMaterial(new GoCipher(), new UrlArgument("some-url"), null, null, "badger", null);
+            TfsMaterial tfsMaterial = new TfsMaterial(new UrlArgument("some-url"), null, null, "badger", null);
 
             assertThat(tfsMaterial.passwordForCommandLine()).isEqualTo("badger");
         }
 
         @Test
         void shouldReturnAResolvedPassword_IfPasswordDefinedAsSecretParam() {
-            TfsMaterial tfsMaterial = new TfsMaterial(new GoCipher(), new UrlArgument("some-url"), null, null, "{{SECRET:[secret_config_id][lookup_pass]}}", null);
+            TfsMaterial tfsMaterial = new TfsMaterial(new UrlArgument("some-url"), null, null, "{{SECRET:[secret_config_id][lookup_pass]}}", null);
 
             tfsMaterial.getSecretParams().findFirst("lookup_pass").ifPresent(secretParam -> secretParam.setValue("resolved_password"));
 
@@ -299,7 +247,7 @@ public class TfsMaterialTest {
 
         @Test
         void shouldErrorOutWhenCalledOnAUnResolvedSecretParam_IfPasswordDefinedAsSecretParam() {
-            TfsMaterial tfsMaterial = new TfsMaterial(new GoCipher(), new UrlArgument("some-url"), null, null, "{{SECRET:[secret_config_id][lookup_pass]}}", null);
+            TfsMaterial tfsMaterial = new TfsMaterial(new UrlArgument("some-url"), null, null, "{{SECRET:[secret_config_id][lookup_pass]}}", null);
 
             assertThatCode(tfsMaterial::passwordForCommandLine)
                     .isInstanceOf(UnresolvedSecretParamException.class)
@@ -311,7 +259,7 @@ public class TfsMaterialTest {
     class setPassword {
         @Test
         void shouldParsePasswordString_IfDefinedAsSecretParam() {
-            TfsMaterial tfsMaterial = new TfsMaterial(new GoCipher(), new UrlArgument("some-url"), null, null, "{{SECRET:[secret_config_id][lookup_pass]}}", null);
+            TfsMaterial tfsMaterial = new TfsMaterial(new UrlArgument("some-url"), null, null, "{{SECRET:[secret_config_id][lookup_pass]}}", null);
 
             assertThat(tfsMaterial.getSecretParams())
                     .hasSize(1)
@@ -339,7 +287,7 @@ public class TfsMaterialTest {
 
     @Test
     void shouldOnlyPopulateDomainEnvVarIfPresent() {
-        TfsMaterial material = new TfsMaterial(mock(GoCipher.class), new UrlArgument(TFS_FIRST_COLLECTION_URL), USERNAME, "", PASSWORD, TFS_FIRST_PROJECT);
+        TfsMaterial material = new TfsMaterial(new UrlArgument(TFS_FIRST_COLLECTION_URL), USERNAME, "", PASSWORD, TFS_FIRST_PROJECT);
         EnvironmentVariableContext ctx = new EnvironmentVariableContext();
         final ArrayList<Modification> modifications = new ArrayList<>();
 

programming_language: Java
filename: DummyMaterial.java
change_type: ModificationType.MODIFY
diff: @@ -18,7 +18,6 @@ package com.thoughtworks.go.domain.materials;
 import com.thoughtworks.go.config.materials.ScmMaterial;
 import com.thoughtworks.go.config.materials.SubprocessExecutionContext;
 import com.thoughtworks.go.domain.MaterialInstance;
-import com.thoughtworks.go.security.GoCipher;
 import com.thoughtworks.go.util.command.ConsoleOutputStreamConsumer;
 import com.thoughtworks.go.util.command.UrlArgument;
 
@@ -35,7 +34,7 @@ public final class DummyMaterial extends ScmMaterial {
     private String url;
 
     public DummyMaterial() {
-        super("DummyMaterial", new GoCipher());
+        super("DummyMaterial");
     }
 
     @Override

programming_language: Java
filename: SvnMaterialTest.java
change_type: ModificationType.MODIFY
diff: @@ -328,30 +328,6 @@ public class SvnMaterialTest {
         assertThat(svnBoozer).isEqualTo(svnZooser);
     }
 
-    @Test
-    void shouldEncryptSvnPasswordAndMarkPasswordAsNull() throws Exception {
-        GoCipher mockGoCipher = mock(GoCipher.class);
-        when(mockGoCipher.encrypt("password")).thenReturn("encrypted");
-
-        SvnMaterial material = new SvnMaterial("/foo", "username", "password", false, mockGoCipher);
-        material.ensureEncrypted();
-
-        assertThat(material.getPassword()).isNull();
-        assertThat(material.getEncryptedPassword()).isEqualTo("encrypted");
-    }
-
-    @Test
-    void shouldDecryptSvnPassword() throws Exception {
-        GoCipher mockGoCipher = mock(GoCipher.class);
-        when(mockGoCipher.decrypt("encrypted")).thenReturn("password");
-
-        SvnMaterial material = new SvnMaterial("/foo", "username", null, false, mockGoCipher);
-        ReflectionUtil.setField(material, "encryptedPassword", "encrypted");
-
-        material.ensureEncrypted();
-        assertThat(material.getPassword()).isEqualTo("password");
-    }
-
     @Test
     void shouldNotDecryptSvnPasswordIfPasswordIsNotNull() throws Exception {
         GoCipher mockGoCipher = mock(GoCipher.class);
@@ -367,33 +343,6 @@ public class SvnMaterialTest {
         assertThat(material.getPassword()).isEqualTo("new_password");
     }
 
-    @Test
-    void shouldErrorOutIfDecryptionFails() throws CryptoException {
-        GoCipher mockGoCipher = mock(GoCipher.class);
-        String fakeCipherText = "fake cipher text";
-        when(mockGoCipher.decrypt(fakeCipherText)).thenThrow(new CryptoException("exception"));
-        SvnMaterial material = new SvnMaterial("/foo", "username", null, false, mockGoCipher);
-        ReflectionUtil.setField(material, "encryptedPassword", fakeCipherText);
-        try {
-            material.getPassword();
-            fail("Should have thrown up");
-        } catch (Exception e) {
-            assertThat(e.getMessage()).isEqualTo("Could not decrypt the password to get the real password");
-        }
-    }
-
-    @Test
-    void shouldErrorOutIfEncryptionFails() throws Exception {
-        GoCipher mockGoCipher = mock(GoCipher.class);
-        when(mockGoCipher.encrypt("password")).thenThrow(new CryptoException("exception"));
-        try {
-            new SvnMaterial("/foo", "username", "password", false, mockGoCipher);
-            fail("Should have thrown up");
-        } catch (Exception e) {
-            assertThat(e.getMessage()).isEqualTo("Password encryption failed. Please verify your cipher key.");
-        }
-    }
-
     @Test
     void shouldGetLongDescriptionForMaterial() {
         SvnMaterial material = new SvnMaterial("http://url/", "user", "password", true, "folder");

programming_language: Java
filename: MagicalMaterialAndMaterialConfigConversionTest.java
change_type: ModificationType.MODIFY
diff: @@ -180,8 +180,7 @@ public class MagicalMaterialAndMaterialConfigConversionTest {
     private void assertPasswordIsCorrect(Material material) {
         if (material instanceof PasswordAwareMaterial) {
             assertThat("Password setting is wrong for: " + material.getClass(), ((PasswordAwareMaterial) material).getPassword(), is("pass"));
-            assertThat("Password setting is wrong for: " + material.getClass(), ReflectionUtil.getField(material, "password"), is(nullValue()));
-            assertThat("Password setting is wrong for: " + material.getClass(), ReflectionUtil.getField(material, "encryptedPassword"), is(not(nullValue())));
+            assertThat("Password setting is wrong for: " + material.getClass(), ReflectionUtil.getField(material, "password"), is("pass"));
         }
     }
 

programming_language: Java
filename: Materials.java
change_type: ModificationType.MODIFY
diff: @@ -32,7 +32,6 @@ import com.thoughtworks.go.domain.BaseCollection;
 import com.thoughtworks.go.domain.ConfigVisitor;
 import com.thoughtworks.go.domain.MaterialRevisions;
 import com.thoughtworks.go.domain.materials.*;
-import com.thoughtworks.go.security.GoCipher;
 import com.thoughtworks.go.util.ArtifactLogUtil;
 import com.thoughtworks.go.util.command.ConsoleOutputStreamConsumer;
 import com.thoughtworks.go.util.command.UrlArgument;
@@ -205,7 +204,7 @@ public class Materials extends BaseCollection<Material> {
     }
 
     public TfsMaterial getTfsMaterial() {
-        return getExistingOrDefaultMaterial(new TfsMaterial(new GoCipher(), new UrlArgument(""), "", "", "", ""));
+        return getExistingOrDefaultMaterial(new TfsMaterial(new UrlArgument(""), "", "", "", ""));
     }
 
     public HgMaterial getHgMaterial() {

programming_language: Java
filename: ScmMaterial.java
change_type: ModificationType.MODIFY
diff: @@ -21,8 +21,6 @@ import com.thoughtworks.go.config.SecretParamAware;
 import com.thoughtworks.go.config.SecretParams;
 import com.thoughtworks.go.domain.MaterialRevision;
 import com.thoughtworks.go.domain.materials.*;
-import com.thoughtworks.go.security.CryptoException;
-import com.thoughtworks.go.security.GoCipher;
 import com.thoughtworks.go.util.command.EnvironmentVariableContext;
 import com.thoughtworks.go.util.command.InMemoryStreamConsumer;
 import com.thoughtworks.go.util.command.ProcessOutputStreamConsumer;
@@ -34,9 +32,7 @@ import java.io.File;
 import java.util.Map;
 import java.util.Optional;
 
-import static com.thoughtworks.go.util.ExceptionUtils.bomb;
 import static com.thoughtworks.go.util.command.EnvironmentVariableContext.escapeEnvironmentVariable;
-import static org.apache.commons.lang3.StringUtils.isBlank;
 
 
 /**
@@ -48,7 +44,6 @@ public abstract class ScmMaterial extends AbstractMaterial implements SecretPara
     public static final String GO_TO_REVISION = "GO_TO_REVISION";
     public static final String GO_FROM_REVISION = "GO_FROM_REVISION";
     public static final String GO_MATERIAL_URL = "GO_MATERIAL_URL";
-    protected final GoCipher goCipher;
 
     protected Filter filter;
     protected String folder;
@@ -56,12 +51,10 @@ public abstract class ScmMaterial extends AbstractMaterial implements SecretPara
     protected boolean invertFilter = false;
     protected String userName;
     protected String password;
-    protected String encryptedPassword;
     protected SecretParams secretParamsForPassword;
 
-    public ScmMaterial(String typeName, GoCipher goCipher) {
+    public ScmMaterial(String typeName) {
         super(typeName);
-        this.goCipher = goCipher;
     }
 
     @Override
@@ -121,26 +114,12 @@ public abstract class ScmMaterial extends AbstractMaterial implements SecretPara
     }
 
     private void resetPassword(String passwordToSet) {
-        if (StringUtils.isBlank(passwordToSet)) {
-            encryptedPassword = null;
-        }
         setPasswordIfNotBlank(passwordToSet);
     }
 
     private void setPasswordIfNotBlank(String password) {
         this.password = StringUtils.stripToNull(password);
         this.secretParamsForPassword = SecretParams.parse(password);
-        this.encryptedPassword = StringUtils.stripToNull(encryptedPassword);
-
-        if (this.password == null) {
-            return;
-        }
-        try {
-            this.encryptedPassword = this.goCipher.encrypt(password);
-        } catch (Exception e) {
-            bomb("Password encryption failed. Please verify your cipher key.", e);
-        }
-        this.password = null;
     }
 
     @PostConstruct
@@ -153,16 +132,8 @@ public abstract class ScmMaterial extends AbstractMaterial implements SecretPara
         this.userName = userName;
     }
 
-    public final void setEncryptedPassword(String encryptedPassword) {
-        this.encryptedPassword = encryptedPassword;
-    }
-
-    public final String getEncryptedPassword() {
-        return encryptedPassword;
-    }
-
     public String getPassword() {
-        return currentPassword();
+        return password;
     }
 
     public String passwordForCommandLine() {
@@ -179,14 +150,6 @@ public abstract class ScmMaterial extends AbstractMaterial implements SecretPara
         return secretParamsForPassword;
     }
 
-    public final String currentPassword() {
-        try {
-            return isBlank(encryptedPassword) ? null : this.goCipher.decrypt(encryptedPassword);
-        } catch (CryptoException e) {
-            throw new RuntimeException("Could not decrypt the password to get the real password", e);
-        }
-    }
-
     public abstract boolean isCheckExternals();
 
     public abstract String getUrl();

programming_language: Java
filename: GitMaterial.java
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,6 @@ import com.thoughtworks.go.domain.materials.git.GitCommand;
 import com.thoughtworks.go.domain.materials.git.GitMaterialInstance;
 import com.thoughtworks.go.domain.materials.git.GitVersion;
 import com.thoughtworks.go.domain.materials.svn.MaterialUrl;
-import com.thoughtworks.go.security.GoCipher;
 import com.thoughtworks.go.server.transaction.TransactionSynchronizationManager;
 import com.thoughtworks.go.util.GoConstants;
 import com.thoughtworks.go.util.command.*;
@@ -65,7 +64,7 @@ public class GitMaterial extends ScmMaterial implements PasswordAwareMaterial {
     private String submoduleFolder;
 
     public GitMaterial(String url) {
-        super(TYPE, new GoCipher());
+        super(TYPE);
         this.url = new UrlArgument(url);
     }
 

programming_language: Java
filename: HgMaterial.java
change_type: ModificationType.MODIFY
diff: @@ -26,7 +26,6 @@ import com.thoughtworks.go.domain.materials.mercurial.HgCommand;
 import com.thoughtworks.go.domain.materials.mercurial.HgMaterialInstance;
 import com.thoughtworks.go.domain.materials.mercurial.HgVersion;
 import com.thoughtworks.go.domain.materials.svn.MaterialUrl;
-import com.thoughtworks.go.security.GoCipher;
 import com.thoughtworks.go.util.GoConstants;
 import com.thoughtworks.go.util.command.*;
 import org.apache.commons.io.FileUtils;
@@ -68,7 +67,7 @@ public class HgMaterial extends ScmMaterial implements PasswordAwareMaterial {
     private String branch;
 
     private HgMaterial() {
-        super(TYPE, new GoCipher());
+        super(TYPE);
     }
 
     public HgMaterial(String url, String folder) {

programming_language: Java
filename: P4Material.java
change_type: ModificationType.MODIFY
diff: @@ -58,32 +58,24 @@ public class P4Material extends ScmMaterial implements PasswordEncrypter, Passwo
     //TODO: use iBatis to set the type for us, and we can get rid of this field.
     public static final String TYPE = "P4Material";
 
-    private P4Material(GoCipher goCipher) {
-        super(TYPE, goCipher);
+    private P4Material() {
+        super(TYPE);
     }
 
-    public P4Material(String serverAndPort, String view, GoCipher goCipher) {
-        this(goCipher);
+    public P4Material(String serverAndPort, String view) {
+        this();
         bombIfNull(serverAndPort, "null serverAndPort");
         this.serverAndPort = serverAndPort;
         setView(view);
     }
 
-    public P4Material(String serverAndPort, String view) {
-        this(serverAndPort, view, new GoCipher());
-    }
-
-    public P4Material(String url, String view, String userName) {
-        this(url, view);
+    public P4Material(String serverAndPort, String view, String userName) {
+        this(serverAndPort, view);
         this.userName = userName;
     }
 
-    public P4Material(String url, String view, String userName, String folder) {
-        this(url, view, userName, folder, new GoCipher());
-    }
-
     public P4Material(P4MaterialConfig config) {
-        this(config.getUrl(), config.getView(), config.getUserName(), config.getFolder(), config.getGoCipher());
+        this(config.getUrl(), config.getView(), config.getUserName(), config.getFolder());
         this.name = config.getName();
         this.autoUpdate = config.getAutoUpdate();
         this.filter = config.rawFilter();
@@ -92,8 +84,8 @@ public class P4Material extends ScmMaterial implements PasswordEncrypter, Passwo
         this.useTickets = config.getUseTickets();
     }
 
-    private P4Material(String serverAndPort, String view, String userName, String folder, GoCipher goCipher) {
-        this(goCipher);
+    public P4Material(String serverAndPort, String view, String userName, String folder) {
+        this();
         bombIfNull(serverAndPort, "null serverAndPort");
         this.serverAndPort = serverAndPort;
         setView(view);

programming_language: Java
filename: SvnMaterial.java
change_type: ModificationType.MODIFY
diff: @@ -53,10 +53,6 @@ public class SvnMaterial extends ScmMaterial implements PasswordEncrypter, Passw
 
     public static final String TYPE = "SvnMaterial";
 
-    private SvnMaterial(GoCipher goCipher) {
-        super("SvnMaterial", goCipher);
-    }
-
     public SvnMaterial(String url, String userName, String password, boolean checkExternals) {
         this(url, userName, password, checkExternals, new GoCipher());
     }
@@ -81,7 +77,7 @@ public class SvnMaterial extends ScmMaterial implements PasswordEncrypter, Passw
     }
 
     public SvnMaterial(String url, String userName, String password, boolean checkExternals, GoCipher goCipher) {
-        super("SvnMaterial", goCipher);
+        super("SvnMaterial");
         bombIfNull(url, "null url");
         setUrl(url);
         this.userName = userName;

programming_language: Java
filename: TfsMaterial.java
change_type: ModificationType.MODIFY
diff: @@ -25,7 +25,6 @@ import com.thoughtworks.go.domain.materials.*;
 import com.thoughtworks.go.domain.materials.tfs.TfsCommand;
 import com.thoughtworks.go.domain.materials.tfs.TfsCommandFactory;
 import com.thoughtworks.go.domain.materials.tfs.TfsMaterialInstance;
-import com.thoughtworks.go.security.GoCipher;
 import com.thoughtworks.go.util.GoConstants;
 import com.thoughtworks.go.util.command.ConsoleOutputStreamConsumer;
 import com.thoughtworks.go.util.command.EnvironmentVariableContext;
@@ -54,12 +53,12 @@ public class TfsMaterial extends ScmMaterial implements PasswordAwareMaterial, P
     private String domain = "";
     private String projectPath;
 
-    public TfsMaterial(GoCipher goCipher) {
-        super(TYPE, goCipher);
+    public TfsMaterial() {
+        super(TYPE);
     }
 
-    public TfsMaterial(GoCipher goCipher, UrlArgument url, String userName, String domain, String password, String projectPath) {
-        this(goCipher);
+    public TfsMaterial(UrlArgument url, String userName, String domain, String password, String projectPath) {
+        this();
         this.url = url;
         this.userName = userName;
         this.domain = domain;
@@ -68,7 +67,7 @@ public class TfsMaterial extends ScmMaterial implements PasswordAwareMaterial, P
     }
 
     public TfsMaterial(TfsMaterialConfig config) {
-        this(config.getGoCipher(), new UrlArgument(config.getUrl()), config.getUserName(), config.getDomain(), config.getPassword(), config.getProjectPath());
+        this(new UrlArgument(config.getUrl()), config.getUserName(), config.getDomain(), config.getPassword(), config.getProjectPath());
         this.autoUpdate = config.getAutoUpdate();
         this.filter = config.rawFilter();
         this.invertFilter = config.getInvertFilter();

programming_language: Java
filename: TestingMaterial.java
change_type: ModificationType.MODIFY
diff: @@ -18,7 +18,6 @@ package com.thoughtworks.go.domain.materials;
 import com.thoughtworks.go.config.materials.ScmMaterial;
 import com.thoughtworks.go.config.materials.SubprocessExecutionContext;
 import com.thoughtworks.go.domain.MaterialInstance;
-import com.thoughtworks.go.security.GoCipher;
 import com.thoughtworks.go.util.command.ConsoleOutputStreamConsumer;
 import com.thoughtworks.go.util.command.UrlArgument;
 import org.joda.time.DateTime;
@@ -40,7 +39,7 @@ public class TestingMaterial extends ScmMaterial {
     private String url;
 
     public TestingMaterial() {
-        super(TYPE, new GoCipher());
+        super(TYPE);
     }
 
     public TestingMaterial(TestingMaterialConfig config) {

programming_language: Java
filename: TfsMaterialInstance.java
change_type: ModificationType.MODIFY
diff: @@ -17,7 +17,6 @@ package com.thoughtworks.go.domain.materials.tfs;
 import com.thoughtworks.go.config.materials.tfs.TfsMaterial;
 import com.thoughtworks.go.domain.MaterialInstance;
 import com.thoughtworks.go.domain.materials.Material;
-import com.thoughtworks.go.security.GoCipher;
 import com.thoughtworks.go.util.command.UrlArgument;
 
 public class TfsMaterialInstance extends MaterialInstance {
@@ -31,7 +30,7 @@ public class TfsMaterialInstance extends MaterialInstance {
     }
 
     @Override public Material toOldMaterial(String name, String folder, String password) {
-        TfsMaterial tfsMaterial = new TfsMaterial(new GoCipher(), new UrlArgument(url), username, domain, password, projectPath);
+        TfsMaterial tfsMaterial = new TfsMaterial(new UrlArgument(url), username, domain, password, projectPath);
         tfsMaterial.setFolder(folder);
         setName(name,tfsMaterial);
         return tfsMaterial;

programming_language: Java
filename: MaterialsMother.java
change_type: ModificationType.MODIFY
diff: @@ -29,7 +29,6 @@ import com.thoughtworks.go.domain.materials.Material;
 import com.thoughtworks.go.domain.packagerepository.*;
 import com.thoughtworks.go.domain.scm.SCM;
 import com.thoughtworks.go.domain.scm.SCMMother;
-import com.thoughtworks.go.security.GoCipher;
 import com.thoughtworks.go.util.command.UrlArgument;
 
 import java.util.Arrays;
@@ -175,7 +174,7 @@ public class MaterialsMother {
     }
 
     public static TfsMaterial tfsMaterial(String url) {
-        return new TfsMaterial(new GoCipher(), new UrlArgument(url), "username", "domain", "password", "project-path");
+        return new TfsMaterial(new UrlArgument(url), "username", "domain", "password", "project-path");
     }
 
     public static SvnMaterial svnMaterial(String svnUrl, String folder) {

programming_language: Java
filename: MaterialServiceTest.java
change_type: ModificationType.MODIFY
diff: @@ -49,7 +49,6 @@ import com.thoughtworks.go.plugin.access.scm.revision.SCMRevision;
 import com.thoughtworks.go.plugin.api.material.packagerepository.PackageConfiguration;
 import com.thoughtworks.go.plugin.api.material.packagerepository.PackageRevision;
 import com.thoughtworks.go.plugin.api.material.packagerepository.RepositoryConfiguration;
-import com.thoughtworks.go.security.GoCipher;
 import com.thoughtworks.go.server.dao.FeedModifier;
 import com.thoughtworks.go.server.domain.Username;
 import com.thoughtworks.go.server.persistence.MaterialRepository;
@@ -200,7 +199,7 @@ public class MaterialServiceTest {
     }, HgMaterial.class);
 
     @DataPoint
-    public static RequestDataPoints TFS_LATEST_MODIFICATIONS = new RequestDataPoints(new TfsMaterial(mock(GoCipher.class)) {
+    public static RequestDataPoints TFS_LATEST_MODIFICATIONS = new RequestDataPoints(new TfsMaterial() {
         @Override
         public List<Modification> latestModification(File baseDir, SubprocessExecutionContext execCtx) {
             return (List<Modification>) MODIFICATIONS;

programming_language: Java
filename: TfsMaterialPersistenceTest.java
change_type: ModificationType.MODIFY
diff: @@ -19,7 +19,6 @@ import com.thoughtworks.go.config.CaseInsensitiveString;
 import com.thoughtworks.go.config.materials.tfs.TfsMaterial;
 import com.thoughtworks.go.domain.MaterialInstance;
 import com.thoughtworks.go.domain.materials.Material;
-import com.thoughtworks.go.security.GoCipher;
 import com.thoughtworks.go.server.cache.GoCache;
 import com.thoughtworks.go.server.dao.DatabaseAccessHelper;
 import com.thoughtworks.go.server.persistence.MaterialRepository;
@@ -64,7 +63,7 @@ public class TfsMaterialPersistenceTest {
 
     @Test
     public void shouldBeAbleToConvertAMaterialInstanceObjectToTfsMaterialObject() {
-        TfsMaterial tfsCfg = new TfsMaterial(new GoCipher(), new UrlArgument("url"), "loser", "CORPORATE", "password", "/dev/null");
+        TfsMaterial tfsCfg = new TfsMaterial(new UrlArgument("url"), "loser", "CORPORATE", "password", "/dev/null");
         tfsCfg.setFolder("folder");
         tfsCfg.setName(new CaseInsensitiveString("materialName"));
         MaterialInstance tfsInstance = materialRepository.findOrCreateFrom(tfsCfg);
@@ -75,7 +74,7 @@ public class TfsMaterialPersistenceTest {
 
     @Test
     public void shouldFindOldMaterial() {
-        TfsMaterial tfsCfg = new TfsMaterial(new GoCipher(), new UrlArgument("url"), "loser", "CORPORATE", "foo_bar_baz", "/dev/null");
+        TfsMaterial tfsCfg = new TfsMaterial(new UrlArgument("url"), "loser", "CORPORATE", "foo_bar_baz", "/dev/null");
         MaterialInstance tfsInstance1 = materialRepository.findOrCreateFrom(tfsCfg);
         goCache.clear();
         MaterialInstance tfsInstance2 = materialRepository.findOrCreateFrom(tfsCfg);
@@ -85,7 +84,7 @@ public class TfsMaterialPersistenceTest {
 
     @Test
     public void shouldSaveMaterialInstance() throws Exception {
-        TfsMaterial tfsCfg = new TfsMaterial(new GoCipher(), new UrlArgument("url"), "loser", "CORPORATE", "foo_bar_baz", "/dev/null");
+        TfsMaterial tfsCfg = new TfsMaterial(new UrlArgument("url"), "loser", "CORPORATE", "foo_bar_baz", "/dev/null");
         MaterialInstance materialInstance = materialRepository.findOrCreateFrom(tfsCfg);
         assertThat(materialRepository.findMaterialInstance(tfsCfg), is(materialInstance));
     }

programming_language: Java