gnodet opened a new pull request, #699: URL: https://github.com/apache/maven-deploy-plugin/pull/699
## Summary Applies 6 LOW-severity robustness findings from the Glasswing static security audit (scan-maven-deploy-plugin-20260811). All confirmed TP with 5/5 adversarial-panel unanimity. **Stacks on #698** (MEDIUM fixes). ### Findings addressed | Finding | Severity | Title | Patch | |---------|----------|-------|-------| | f007 | LOW | `skip` is a fail-open tri-state — unrecognized values silently publish | bug_07 | | f008 | LOW | Snapshot deploy silently falls back to the release repository | bug_08 | | f009 | LOW | No client-side release/snapshot policy guard; alt route gets API-default policies | bug_09 | | f010 | LOW | Repository strings logged verbatim — URL-embedded userinfo leaks to CI logs | bug_10 | | f011 | LOW | No containment on deploy-file file/files/sources/javadoc paths — composable exfil primitive | bug_11 | | f012 | LOW | Alt-repo parse quirks: legacy pattern first, empty id accepted | bug_12 | ### Changes - **f007:** Shared `parseSkipMode` in both mojos — `true/false/releases/snapshots` matched case-insensitively; unrecognized values (typos like `ture`) now fail the build instead of silently deploying. Deploy-file `releases`/`snapshots` classification reordered after coordinate resolution - **f008:** WARN with fallback id+URL when a declared-but-unusable `snapshotRepository` routes a snapshot to the release repository - **f009:** `warnIfPolicyMismatch` WARNs pre-upload when the selected repository's explicit releases/snapshots policy rejects the artifact kind; enforcement stays server-side - **f010:** `redactUrlUserInfo` masks `scheme://userinfo@` as `scheme://***@` at all log sites; deploy lines log `id (redacted-url)` - **f011:** New opt-in `maven.deploy.file.containedIn` parameter: restricts all deploy-file path inputs to a containment directory (off by default) - **f012:** Fail-closed alt-repo parse: empty-trimmed id/url refused; ambiguous legacy `id::layout::url` whose URL part contains `::` refused ### Breaking changes - `skip` vocabulary is now fail-closed: unrecognized values fail the build - Ambiguous legacy `id::layout::url` alt-repo values now refused (was silently misdeploying) ### Test plan - [x] All 45 tests pass (36 existing + 9 new) - [x] Build verified locally with Maven 4 rc-5 **Audit source:** `scan-maven-deploy-plugin-20260811.zip` 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
