[
https://issues.apache.org/jira/browse/NUTCH-3192?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on NUTCH-3192 started by Lewis John McGibbney.
---------------------------------------------------
> Address Yetus detsecrets/blanks and SonarCloud security findings in config
> templates and DummySSL
> -------------------------------------------------------------------------------------------------
>
> Key: NUTCH-3192
> URL: https://issues.apache.org/jira/browse/NUTCH-3192
> Project: Nutch
> Issue Type: Improvement
> Components: ci/cd, security
> Affects Versions: 1.22
> Reporter: Lewis John McGibbney
> Assignee: Lewis John McGibbney
> Priority: Major
> Fix For: 1.23
>
>
> Yetus and SonarCloud report several security / style findings that are
> largely scanner noise or weak-protocol defaults rather than real credential
> leaks:
>
> *Yetus*
> * conf/index-writers.xml.template: detsecrets on RabbitMQ default
> amqp://guest:guest@localhost:5672/
> * conf/httpclient-auth.xml.template: trailing blanks; detsecrets on
> docstring example passwords
>
> *SonarCloud (apache_nutch)*
> * secrets:S6736 on RabbitIndexWriter password-masking regex (false positive;
> not a hardcoded secret)
> * java:S4423 on DummySSLProtocolSocketFactory using
> SSLContext.getInstance("SSL")
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
