[
https://issues.apache.org/jira/browse/GROOVY-12266?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18105418#comment-18105418
]
ASF GitHub Bot commented on GROOVY-12266:
-----------------------------------------
paulk-asert opened a new pull request, #2803:
URL: https://github.com/apache/groovy/pull/2803
… protocol
Neither engine checked the scheme of a resolver root, so a @GrabResolver
naming an http:// repository silently fetched artifacts that anyone on the path
could read or replace, and placed that repository first in lookup order. Both
engines default to an https central repository, so this only arose for
explicitly configured resolvers.
Add -Dgroovy.grape.insecureProtocolPolicy, taking fail, warn or ignore and
defaulting to warn, so that the resolver is reported but still added. The
values mirror Maven's checksum-policy vocabulary. An unrecognised value falls
back to warn rather than ignore, reported once, so that a typo cannot silently
disable the check.
The check lives in the Grape facade rather than in either engine because
every documented route to adding a resolver
> Grape: warn on plaintext HTTP resolver roots in @GrabResolver
> -------------------------------------------------------------
>
> Key: GROOVY-12266
> URL: https://issues.apache.org/jira/browse/GROOVY-12266
> Project: Groovy
> Issue Type: Improvement
> Reporter: Paul King
> Assignee: Paul King
> Priority: Major
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
