Command line dump reveals proxy user/password in case of errors
---------------------------------------------------------------
Key: MJAVADOC-158
URL: http://jira.codehaus.org/browse/MJAVADOC-158
Project: Maven 2.x Javadoc Plugin
Issue Type: Improvement
Environment: Maven version: 2.0.7 Java version: 1.4.2 OS name:
"windows xp" version: "5.1" arch: "x86"
Reporter: Michele Lorenzini
Priority: Minor
If http proxy is set, in case of error calling javadoc, the whole command line
call is dumped out on console.
This can reveal sensible information about personal proxy settings (user and
password) which are passed
via -J-Dhttp.proxyUser= and -J-Dhttp.proxyPassword= arguments to the javadoc
executable.
For example:
Command line was:"C:\Program
Files\IBM\WebSphere\AppServer\java\jre\..\bin\javadoc.exe"
-J-DproxyHost=urlofmyproxy -J-DproxyPort=8080 -J-Dhttp.proxySet=true
-J-Dhttp.proxyHost=urlofmyproxy -J-Dhttp.proxyPort=8080
-J-Dhttp.nonProxyHosts="myinternalrepo" -J-Dhttp.proxyUser="FOO"
-J-Dhttp.proxyPassword="BAR" @options @packages
If this can be an issue, consider hiding these values in the dump.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.codehaus.org/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
