gnodet opened a new pull request, #2081: URL: https://github.com/apache/maven-resolver/pull/2081
## Summary Fixes 4 findings from the maven-resolver security audit (scan-maven-resolver-20260811): | Finding | Severity | Description | |---------|----------|-------------| | f004 | MEDIUM | HTTP error-response bodies read unbounded into memory (decompression-amplified OOM) | | f024 | LOW | Hostile remote checksum file causes unbounded allocation | | f026 | LOW | Server Last-Modified future date permanently pins artifact against refresh | | f028 | LOW | Remote-derived strings reach console logs without control-character sanitization | **Root cause:** Response bodies, checksum files, timestamps, and strings from the remote side are consumed with no size cap, no plausibility clamp, and no control-character sanitization. **Fix:** Bound before allocating: cap error-body and checksum reads, clamp timestamps, sanitize control characters in log messages. ## Test plan - [ ] Existing tests pass - [ ] Error body read capped at 64KB - [ ] Checksum file read capped - [ ] Last-Modified clamping tested - [ ] Control character sanitization tested 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
