github-advanced-security[bot] commented on code in PR #746:
URL: https://github.com/apache/ws-wss4j/pull/746#discussion_r4246810451
##########
ws-security-common/src/main/java/org/apache/wss4j/common/util/Loader.java:
##########
@@ -130,6 +130,22 @@
return is;
}
+ /**
+ * Return true if <code>path</code> names an existing file. A caller that
is not
+ * permitted to read the path (e.g. under a SecurityManager without the
relevant
+ * FilePermission) is treated as if the file does not exist, so that
resolution falls
+ * through to the URL and classpath lookups rather than failing outright.
No privilege
+ * is asserted on the caller's behalf.
+ */
+ private static boolean isExistingFile(Path path) {
+ try {
+ return Files.exists(path);
+ } catch (SecurityException ex) {
+ LOG.debug("Not permitted to check the file system for [{}]", path,
ex);
Review Comment:
## CodeQL / Insertion of sensitive information into log files
This [potentially sensitive information](1) is written to a log file.
[Show more
details](https://github.com/apache/ws-wss4j/security/code-scanning/428)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
