paulk-asert opened a new pull request, #2803: URL: https://github.com/apache/groovy/pull/2803
… protocol Neither engine checked the scheme of a resolver root, so a @GrabResolver naming an http:// repository silently fetched artifacts that anyone on the path could read or replace, and placed that repository first in lookup order. Both engines default to an https central repository, so this only arose for explicitly configured resolvers. Add -Dgroovy.grape.insecureProtocolPolicy, taking fail, warn or ignore and defaulting to warn, so that the resolver is reported but still added. The values mirror Maven's checksum-policy vocabulary. An unrecognised value falls back to warn rather than ignore, reported once, so that a typo cannot silently disable the check. The check lives in the Grape facade rather than in either engine because every documented route to adding a resolver -- @GrabResolver, the grape command line tool, and Grape.addResolver -- passes through it, so the Ivy and Maven engines are covered by one implementation and behave alike. Roots naming a loopback host are exempt under every policy since they do not cross a network, and each distinct root is reported at most once. Classification is an allow-list of known-plaintext schemes, currently http and ftp, so that encrypted transports such as s3 and gs are not reported falsely; file: roots are never insecure, as they cross no network and a network-mounted one cannot be told apart from a local one by inspecting the URI. Integrity for those repositories is checksum verification's job, which applies to every transport rather than only to remote ones. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
