gnodet-bot commented on code in PR #13589:
URL: https://github.com/apache/maven/pull/13589#discussion_r4302179964
##########
maven-embedder/src/main/java/org/apache/maven/cli/MavenCli.java:
##########
@@ -1013,6 +1016,40 @@ private List<File> parseExtClasspath(CliRequest
cliRequest) {
return jars;
}
+ /**
+ * Reads a password from the console and, when there is none because the
streams are redirected, from the first
+ * line of the given input.
+ *
+ * @param console the console, or {@code null} if the streams are
redirected
+ * @param in the input to read the first line from when there is no console
+ * @param prompt the prompt shown by the console; it is not shown when the
password is read from the input, as
+ * the caller is then not interactive and the prompt would
only pollute its output
+ * @return the password, never empty
+ * @throws IOException if the input cannot be read
+ * @throws IllegalStateException if no password could be read, so that an
empty one is not encrypted
+ */
+ static String readPassword(Console console, InputStream in, String prompt)
throws IOException {
+ String password;
+ if (console != null) {
+ char[] chars = console.readPassword(prompt);
+ password = (chars == null) ? null : String.copyValueOf(chars);
+
+ if (chars != null) {
+ // Sun/Oracle advises to empty the char array
+ java.util.Arrays.fill(chars, ' ');
+ }
+ } else {
+ // do not close the reader, that would close the standard input
+ password = new BufferedReader(new InputStreamReader(in,
Charset.defaultCharset())).readLine();
Review Comment:
`Charset.defaultCharset()` makes the stdin decoding locale-dependent. On a
system whose default charset is not UTF-8 (e.g. Windows with Cp1252, or
ISO-8859-1 locales), a piped password containing non-ASCII characters would be
decoded incorrectly. The test encodes its input with `StandardCharsets.UTF_8`
(see the test file, line 88), so the mismatch would not be caught on non-UTF-8
systems. Since `StandardCharsets.UTF_8` is already imported, use it here for
consistency and portability.
```suggestion
password = new BufferedReader(new InputStreamReader(in,
StandardCharsets.UTF_8)).readLine();
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
