Security audit: LOW robustness fixes — skip, fallback, policy, redaction, containment, parse - #699
Open
gnodet wants to merge 9 commits into
Open
Security audit: LOW robustness fixes — skip, fallback, policy, redaction, containment, parse#699gnodet wants to merge 9 commits into
gnodet wants to merge 9 commits into
Conversation
3 tasks
…kipMode(value, parame Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…sitory declared' (doc Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ic limit the audit re Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…heme://userinfo@ as s Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ion (pipeline variabl Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
… swap: reordering the Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet
force-pushed
the
security/audit-low-robustness
branch
from
August 31, 2026 13:45
01b6a86 to
b8e8bcb
Compare
The f007 patch intentionally moved the releases/snapshots skip check after version resolution so that a version supplied via the jar's embedded POM is classified correctly. This means the jar IS inspected before the skip decision, which is expected. Update the IT to assert what matters (the deployment was skipped) instead of an implementation detail (whether the jar was opened). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Same fix as deployfile-release-skip: the jar is inspected to resolve the version before the snapshots skip check, which is the intended behavior of the version-aware skip reordering (f007). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
4 tasks
On macOS, /var is a symlink to /private/var. When a non-existent path (e.g. an artifact that hasn't been created yet) is checked against an existing containment root, toRealPath() fails for the child but succeeds for the root — giving /var/... vs /private/var/..., which breaks the startsWith check. Fix realOrNormalized() to walk up to the closest existing ancestor, resolve its real path, then re-append the non-existent suffix. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet
marked this pull request as ready for review
September 1, 2026 21:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Applies 6 LOW-severity robustness findings from the Glasswing static security audit (scan-maven-deploy-plugin-20260811). All confirmed TP with 5/5 adversarial-panel unanimity. Stacks on #698 (MEDIUM fixes).
Findings addressed
skipis a fail-open tri-state — unrecognized values silently publishChanges
parseSkipModein both mojos —true/false/releases/snapshotsmatched case-insensitively; unrecognized values (typos liketure) now fail the build instead of silently deploying. Deploy-filereleases/snapshotsclassification reordered after coordinate resolutionsnapshotRepositoryroutes a snapshot to the release repositorywarnIfPolicyMismatchWARNs pre-upload when the selected repository's explicit releases/snapshots policy rejects the artifact kind; enforcement stays server-sideredactUrlUserInfomasksscheme://userinfo@asscheme://***@at all log sites; deploy lines logid (redacted-url)maven.deploy.file.containedInparameter: restricts all deploy-file path inputs to a containment directory (off by default)id::layout::urlwhose URL part contains::refusedBreaking changes
skipvocabulary is now fail-closed: unrecognized values fail the buildid::layout::urlalt-repo values now refused (was silently misdeploying)Test plan
Audit source:
scan-maven-deploy-plugin-20260811.zip🤖 Generated with Claude Code