elharo opened a new issue, #145:
URL: https://github.com/apache/maven-jarsigner-plugin/issues/145

   **Affected version:** HEAD
   
   **Files:** 
   - 
`src/main/java/org/apache/maven/plugins/jarsigner/AbstractJarsignerMojo.java:376`
   - 
`src/main/java/org/apache/maven/plugins/jarsigner/JarsignerSignMojo.java:251`
   
   Both `getCommandlineInfo()` methods call 
`StringUtils.replace(commandLineInfo, this.storepass/keypass, mask)` where the 
password field can be null when the user hasn't configured a `storepass` or 
`keypass`:
   
   ```java
   // AbstractJarsignerMojo.java:376
   commandLineInfo = StringUtils.replace(commandLineInfo, this.storepass, 
"'*****'");
   
   // JarsignerSignMojo.java:251
   commandLineInfo = StringUtils.replace(commandLineInfo, this.keypass, 
"'*****'");
   ```
   
   If `StringUtils.replace` delegates to `String.replace(CharSequence, 
CharSequence)` (which throws NPE on null target), this crashes whenever 
jarsigner returns a non-zero exit code and tries to log the command line, but 
the user hasn't set a password.
   
   The fix should guard the call: only attempt replacement when the password is 
non-null.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to