elharo opened a new issue, #165:
URL: https://github.com/apache/maven-resolver-ant-tasks/issues/165
## Summary
`AntRepoSys.getProxySelector()` adds every `<proxy>` entry from
`settings.xml` to the aether `DefaultProxySelector` without checking
`isActive()`. Disabled proxies therefore still route all artifact downloads.
## Affected code
`src/main/java/org/apache/maven/resolver/internal/ant/AntRepoSys.java` lines
420-429 (master @ `df2908e`)
```java
Settings settings = getSettings();
for (org.apache.maven.settings.Proxy proxy : settings.getProxies()) {
AuthenticationBuilder auth = new AuthenticationBuilder();
auth.addUsername(proxy.getUsername()).addPassword(proxy.getPassword());
selector.add(
new org.eclipse.aether.repository.Proxy(
proxy.getProtocol(), proxy.getHost(),
proxy.getPort(), auth.build()),
proxy.getNonProxyHosts());
}
```
## Problem
Maven's `DefaultSettingsBuilder` keeps inactive proxies in the effective
settings (it does not filter them out), and `DefaultProxySelector` returns the
first matching proxy. Maven CLI avoids this by selecting the proxy via
`settings.getActiveProxy()`, which returns the first proxy with `isActive() ==
true` and otherwise `null`. This code adds every proxy unconditionally, so a
proxy the user disabled with `<active>false</active>` still hijacks all
transfers.
## Expected behavior
Only the active proxy (the first with `isActive() == true`) should be added
to the selector, matching Maven CLI behavior.
## Impact
- Dependency resolution failures through a proxy the user explicitly disabled
- Traffic unexpectedly routed through an (inactive) corporate/filtering
proxy — potentially a security concern
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
