This is an automated email from the ASF dual-hosted git repository. gnodet pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/maven-resolver.git
commit 7f10ebd22a0445b70f427a3e0c11b06b97a75c6c Author: Guillaume Nodet <[email protected]> AuthorDate: Sun Jun 7 06:28:39 2026 +0000 Fix Apache BasicAuthCache thread safety — use ConcurrentHashMap-backed AuthCache F-06: Replace BasicAuthCache (backed by plain HashMap) with a ConcurrentAuthCache backed by ConcurrentHashMap, preventing data corruption when concurrent requests call authCache.put() during preemptive auth. --- .../aether/transport/apache/ApacheTransporter.java | 38 ++++++++++++++++++++-- 1 file changed, 35 insertions(+), 3 deletions(-) diff --git a/maven-resolver-transport-apache/src/main/java/org/eclipse/aether/transport/apache/ApacheTransporter.java b/maven-resolver-transport-apache/src/main/java/org/eclipse/aether/transport/apache/ApacheTransporter.java index 325360e50..7a1f92905 100644 --- a/maven-resolver-transport-apache/src/main/java/org/eclipse/aether/transport/apache/ApacheTransporter.java +++ b/maven-resolver-transport-apache/src/main/java/org/eclipse/aether/transport/apache/ApacheTransporter.java @@ -33,6 +33,7 @@ import java.util.Date; import java.util.List; import java.util.Map; import java.util.Set; +import java.util.concurrent.ConcurrentHashMap; import java.util.function.Function; import java.util.regex.Matcher; @@ -43,6 +44,7 @@ import org.apache.http.HttpHeaders; import org.apache.http.HttpHost; import org.apache.http.HttpResponse; import org.apache.http.HttpStatus; +import org.apache.http.auth.AuthScheme; import org.apache.http.auth.AuthSchemeProvider; import org.apache.http.auth.AuthScope; import org.apache.http.client.AuthCache; @@ -73,7 +75,6 @@ import org.apache.http.impl.auth.DigestSchemeFactory; import org.apache.http.impl.auth.KerberosSchemeFactory; import org.apache.http.impl.auth.NTLMSchemeFactory; import org.apache.http.impl.auth.SPNegoSchemeFactory; -import org.apache.http.impl.client.BasicAuthCache; import org.apache.http.impl.client.CloseableHttpClient; import org.apache.http.impl.client.DefaultHttpRequestRetryHandler; import org.apache.http.impl.client.HttpClientBuilder; @@ -294,9 +295,9 @@ final class ApacheTransporter extends AbstractTransporter implements HttpTranspo Keys.of( getClass(), repository.getId() + "-" + StringDigestUtil.sha1(repository.toString())), - BasicAuthCache::new); + ConcurrentAuthCache::new); } else { - this.authCache = new BasicAuthCache(); + this.authCache = new ConcurrentAuthCache(); } this.client = builder.build(); } @@ -765,4 +766,35 @@ final class ApacheTransporter extends AbstractTransporter implements HttpTranspo return ri; } } + + static class ConcurrentAuthCache implements AuthCache { + private final ConcurrentHashMap<HttpHost, AuthScheme> map = new ConcurrentHashMap<>(); + + @Override + public void put(HttpHost host, AuthScheme authScheme) { + if (host != null && authScheme != null) { + map.put(host, authScheme); + } + } + + @Override + public AuthScheme get(HttpHost host) { + if (host == null) { + return null; + } + return map.get(host); + } + + @Override + public void remove(HttpHost host) { + if (host != null) { + map.remove(host); + } + } + + @Override + public void clear() { + map.clear(); + } + } }
