Re: [PR] [SCM-1028] Fix clear password logging vulnerability [maven-scm]

[via GitHub]

michael-o commented on code in PR #237:
URL: https://github.com/apache/maven-scm/pull/237#discussion_r2030239399


##########
maven-scm-providers/maven-scm-providers-git/maven-scm-provider-git-commons/src/main/java/org/apache/maven/scm/provider/git/util/GitUtil.java:
##########
@@ -77,4 +86,24 @@ public static void setSettingsDirectory(File directory) {
     public static File getSettingsFile() {
         return new File(settingsDirectory, GIT_SETTINGS_FILENAME);
     }
+
+    /**
+     * Provides an anonymous output to mask password. Considering URL of type :
+     * 
<<protocol>>://<<user>>:<<password>>@
+     * <<host_definition>>
+     *
+     * @param urlWithCredentials
+     * @return urlWithCredentials but password masked with stars
+     */
+    public static String maskPasswordInUrl(String urlWithCredentials) {
+        String output = urlWithCredentials;
+        final Matcher passwordMatcher = 
PASSWORD_IN_URL_PATTERN.matcher(output);
+        if (passwordMatcher.find()) {

Review Comment:
   Why do you use `find()` and not `matches()` although your regex goes from 
start to end?



##########
maven-scm-providers/maven-scm-providers-git/maven-scm-provider-git-commons/src/main/java/org/apache/maven/scm/provider/git/util/GitUtil.java:
##########
@@ -77,4 +86,24 @@ public static void setSettingsDirectory(File directory) {
     public static File getSettingsFile() {
         return new File(settingsDirectory, GIT_SETTINGS_FILENAME);
     }
+
+    /**
+     * Provides an anonymous output to mask password. Considering URL of type :
+     * 
<<protocol>>://<<user>>:<<password>>@
+     * <<host_definition>>
+     *
+     * @param urlWithCredentials
+     * @return urlWithCredentials but password masked with stars
+     */
+    public static String maskPasswordInUrl(String urlWithCredentials) {
+        String output = urlWithCredentials;
+        final Matcher passwordMatcher = 
PASSWORD_IN_URL_PATTERN.matcher(output);
+        if (passwordMatcher.find()) {
+            // clear password with delimiters
+            final String clearPasswordWithDelimiters = 
passwordMatcher.group(1);
+            // to be replaced in output by stars with delimiters

Review Comment:
   stars => asterisks



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org