Access Bamboo secret/password variable?

Question

My team has some old bamboo pipelines, where secret and password are configured in bamboo variables and bamboo masks these values with ***** nobody knows the passwords now and it has not been documented.

Is there any way to access/print and see the values in bamboo [secret/password] variable?

Tomboy

I know this is old, but if you can, reset the password – Undesirable

Answer 1

There's a trick to read secret variables:

Create a Script task with content

echo ${bamboo_password_variable} > text.txt

Add artifact definition for *.txt pattern for a Job

Run build and look at text.txt artifact content.

Venery

I can confirm that the file will get the right content, but it is not possible to see it from Bamboo log. So the file should be pushed somewhere outside of Bamboo, then it can be viewed. – Addict

We are using Bamboo 6.10.3 and this does not work. the text file simply contains {bamboo_password_variable} without the dollar sign. We tried Shell, powershell and cmd and none of them worked. – Dalmatian

for Windows you should use format echo %bamboo_password_variable% – Venery

Answer 2

Another solution would be to not display the secret as it is but to display it slightly modified.

For example you could create a script at the start of your Bamboo task (or wherever you want it doesn't matter) and to split the secret value and then display it on 2 different lines.
This way Bamboo would not replace the printed secret by the infamous *******

echo ----------------------------
secret=${bamboo.blabla.secret}
middle=$(echo $secret | awk '{print length($0)/2}')
echo $secret | cut -c1-$middle
echo $secret | cut -c$(($middle+1))-$(echo $secret | awk '{print length}')
echo ----------------------------

(I'm not a bash expert, so there is probably a better way to write this script).
And the output should look like this:

build   28-May-2024 21:35:42    ----------------------------
build   28-May-2024 21:35:42    my-secre
build   28-May-2024 21:35:42    t-value
build   28-May-2024 21:35:42    ----------------------------

You can then concatenate the 2 lines to get your secret value.
Here it would be: my-secret-value

A little bit hacky/dirty but it works 😊

Inefficacy