You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "gnodet (via GitHub)" <gi...@apache.org> on 2026/08/30 18:58:44 UTC

[PR] fix: harden opt-in transport and lock backends against unauthenticated infrastructure [maven-resolver]

gnodet opened a new pull request, #2086:
URL: https://github.com/apache/maven-resolver/pull/2086

   ## Summary
   
   Fixes 4 findings from the maven-resolver security audit (scan-maven-resolver-20260811):
   
   | Finding | Severity | Description |
   |---------|----------|-------------|
   | f031 | MEDIUM | Plaintext `minio+http`/`s3+http` repositories evade `external:http:*` blocking |
   | f032 | MEDIUM | Default-config Hazelcast member in build JVM accepts unauthenticated LAN peers |
   | f033 | MEDIUM | Redis lock backend trusted unconditionally over unauthenticated plaintext |
   | f034 | LOW | Swapped `ConfigUtils.getString` args ignore bucket config, misroute artifacts |
   
   **Root cause:** Three opt-in modules place infrastructure that gates local-repository integrity outside every defense the platform otherwise applies: MinIO plaintext evades `external:http:*`, Hazelcast boots with no auth on defaults, Redis accepts any plaintext address.
   
   **Fix:** Make enabling insecure backends a loud, deliberate act: refuse plaintext without opt-in, fail fast without explicit config, document trust boundary.
   
   ## Test plan
   - [ ] Existing tests pass
   - [ ] MinIO plaintext rejection tested
   - [ ] Hazelcast fail-fast without config tested
   - [ ] Redis plaintext refusal tested
   - [ ] ConfigUtils.getString arg order fixed and unit tested
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix: harden opt-in transport and lock backends against unauthenticated infrastructure [maven-resolver]

Posted by "cstamas (via GitHub)" <gi...@apache.org>.
cstamas merged PR #2086:
URL: https://github.com/apache/maven-resolver/pull/2086


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org