[jira] [Work started] (NUTCH-3192) Address Yetus detsecrets/blanks and SonarCloud security findings in config templates and DummySSL

["Lewis John McGibbney (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/NUTCH-3192?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Work on NUTCH-3192 started by Lewis John McGibbney.
---------------------------------------------------
> Address Yetus detsecrets/blanks and SonarCloud security findings in config templates and DummySSL
> -------------------------------------------------------------------------------------------------
>
>                 Key: NUTCH-3192
>                 URL: https://issues.apache.org/jira/browse/NUTCH-3192
>             Project: Nutch
>          Issue Type: Improvement
>          Components: ci/cd, security
>    Affects Versions: 1.22
>            Reporter: Lewis John McGibbney
>            Assignee: Lewis John McGibbney
>            Priority: Major
>             Fix For: 1.23
>
>
> Yetus and SonarCloud report several security / style findings that are largely scanner noise or weak-protocol defaults rather than real credential leaks:
>  
> *Yetus*
>  * conf/index-writers.xml.template: detsecrets on RabbitMQ default amqp://guest:guest@localhost:5672/
>  * conf/httpclient-auth.xml.template: trailing blanks; detsecrets on docstring example passwords
>  
> *SonarCloud (apache_nutch)*
>  * secrets:S6736 on RabbitIndexWriter password-masking regex (false positive; not a hardcoded secret)
>  * java:S4423 on DummySSLProtocolSocketFactory using SSLContext.getInstance("SSL")



--
This message was sent by Atlassian Jira
(v8.20.10#820010)