CI/CD masked values visible in pipeline editor errors

Summary

On a GitLab Self-Managed instance v17.4.2,

When using the following YAML code:

include:
  - component: $CI_SERVER_FQDN/repository_path/component_name@$MASKED_VARIABLE

Since MASKED_VARIABLE isn't a valid component version, I get an error in the pipeline editor displaying the full string with the value of my MASKED_VARIABLE, thus it's not masked.

I have not tested this further so it might happen in other cases as well.

Steps to reproduce

• Have a CI/CD component project.
• Include it as usual via the pipeline editor.
• Replace the version with a masked CI/CD variable.
• See the value of the masked variable in the error message.

What is the current bug behavior?

Displays masked variables values in error messages.

What is the expected correct behavior?

Hidden value, like [MASKED] or something similar.