Lewis John McGibbney created NUTCH-3192:
-------------------------------------------
Summary: Address Yetus detsecrets/blanks and SonarCloud security
findings in config templates and DummySSL
Key: NUTCH-3192
URL: https://issues.apache.org/jira/browse/NUTCH-3192
Project: Nutch
Issue Type: Improvement
Components: ci/cd, security
Affects Versions: 1.22
Reporter: Lewis John McGibbney
Assignee: Lewis John McGibbney
Fix For: 1.23
Yetus and SonarCloud report several security / style findings that are largely
scanner noise or weak-protocol defaults rather than real credential leaks:
*Yetus*
* conf/index-writers.xml.template: detsecrets on RabbitMQ default
amqp://guest:guest@localhost:5672/
* conf/httpclient-auth.xml.template: trailing blanks; detsecrets on docstring
example passwords
*SonarCloud (apache_nutch)*
* secrets:S6736 on RabbitIndexWriter password-masking regex (false positive;
not a hardcoded secret)
* java:S4423 on DummySSLProtocolSocketFactory using
SSLContext.getInstance("SSL")
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
