[
https://issues.apache.org/jira/browse/NUTCH-3192?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18098652#comment-18098652
]
ASF GitHub Bot commented on NUTCH-3192:
---------------------------------------
lewismc opened a new pull request, #944:
URL: https://github.com/apache/nutch/pull/944
Fix for [NUTCH-3192](https://issues.apache.org/jira/browse/NUTCH-3192)
- Replace shipped RabbitMQ URI defaults with `amqp://localhost:5672/`
(index-writers template, nutch-default `rabbitmq.publisher.server.uri`,
indexer-rabbit README); document that a typical local broker uses the
well-known guest/guest account and that operators must supply
`username:password@` when required
- Change DummySSL SSLContext protocol from "`SSL`" to "`TLS`" (keep
intentional trust-all behavior for protocol-httpclient). Do we need to rename
the Method and Class?
- Strip trailing whitespace in `httpclient-auth.xml.template` and replace
example credentials with `YOUR_USERNAME` / `YOUR_PASSWORD` placeholders
- Mark S6736 as false positive in SonarCloud (masking regex in describe())
> Address Yetus detsecrets/blanks and SonarCloud security findings in config
> templates and DummySSL
> -------------------------------------------------------------------------------------------------
>
> Key: NUTCH-3192
> URL: https://issues.apache.org/jira/browse/NUTCH-3192
> Project: Nutch
> Issue Type: Improvement
> Components: ci/cd, security
> Affects Versions: 1.22
> Reporter: Lewis John McGibbney
> Assignee: Lewis John McGibbney
> Priority: Major
> Fix For: 1.23
>
>
> Yetus and SonarCloud report several security / style findings that are
> largely scanner noise or weak-protocol defaults rather than real credential
> leaks:
>
> *Yetus*
> * conf/index-writers.xml.template: detsecrets on RabbitMQ default
> amqp://guest:guest@localhost:5672/
> * conf/httpclient-auth.xml.template: trailing blanks; detsecrets on
> docstring example passwords
>
> *SonarCloud (apache_nutch)*
> * secrets:S6736 on RabbitIndexWriter password-masking regex (false positive;
> not a hardcoded secret)
> * java:S4423 on DummySSLProtocolSocketFactory using
> SSLContext.getInstance("SSL")
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
