elharo commented on issue #348: URL: https://github.com/apache/maven-antrun-plugin/issues/348#issuecomment-5142332628
gemini found something important here: ### Problem Analysis In version 3.2.0 of `maven-antrun-plugin`, the log level for exporting Ant properties back to Maven was changed from `DEBUG` to `WARN`. When `<exportAntProperties>` is enabled, every Maven property passed into the Ant execution triggers a `WARN`-level log entry upon completion. This change causes two main problems: 1. **Log Spam**: Projects with numerous Maven properties produce hundreds of warning messages during standard builds, obscuring genuine issues. 2. **Security/Information Exposure**: `WARN` messages display property keys and their interpolated string values in plain text. Any sensitive credentials (such as tokens or passwords defined in `settings.xml` or properties) are exposed at standard build verbosity levels. --- ### Recommended Solution To resolve the issue correctly, the plugin maintainers should implement the following changes: 1. **Revert the Log Level to `DEBUG**`: Re-exporting existing properties is part of the standard execution path and does not indicate an error or misconfiguration. Changing `getLog().warn(...)` back to `getLog().debug(...)` eliminates build log noise and prevents sensitive value exposure at standard log levels. 2. **Compare Property Values Before Logging**: If a warning is intended to alert users about overridden properties, the plugin should compare the Ant property value with the pre-existing Maven property value. A warning should only be generated when a value actually changes. 3. **Omit Property Values from Warning Logs**: If any warning condition is retained, it should log only the property key name rather than the value itself to avoid leaking sensitive data into build outputs. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
