feat(java): detect Jenkins Secret credential getter returning plaintext via getPlainText() (CWE-522)

[ai-anant]

Detects a data-bound getter that returns a hudson.util.Secret credential's plaintext via Secret.getPlainText().

Pattern (generic): a get* method (public or package-private) whose body is return <expr>.getPlainText();.

Why it matters: in a Jenkins extension model class, a getter that returns Secret.getPlainText() instead of the Secret object itself defeats Jenkins' secret masking. The value is embedded in the rendered configuration page source, replayed verbatim by the config form on every submit, and surfaced through Stapler property binding — exposing the credential to anyone who can view/exchange that page or property.

Rule: codevigilant.java.jenkins.credentials.secret-getter-plaintext (HIGH, CWE-522/CWE-200) — java/jenkins/credentials/secret-getter-plaintext.yaml.

Validated with semgrep --validate --config java/ and tested against positive/sanitized negatives:

• pos: getters returning $\{receiver\}.getPlainText() fire
• neg: getter returning the Secret object (correct), non-secret getters do not fire

Generic guidance only; no specific project referenced.