slachiewicz opened a new pull request, #2117:
URL: https://github.com/apache/maven-resolver/pull/2117
### Summary
This PR implements two security hardening improvements for Maven Resolver
2.0.23:
1. **[f020] Require bootstrap token handshake for IPC client connections**:
- On Windows and TCP/inet sockets, any local user could previously
connect to the IPC daemon socket and request or hold named locks, risking local
denial of service.
- `IpcClient` now writes the daemon address and a random bootstrap token
tab-separated (`address\ttoken`) into the user-scoped lock file.
- Upon connection, the client sends this token as an immediate handshake.
`IpcServer` validates the token and disconnects unauthorized connections
immediately before processing any commands.
2. **[f033] Validate node addresses in Redisson YAML configuration**:
- When loading Redisson configuration from YAML (`Config.fromYAML`),
plaintext non-loopback addresses (`redis://`) are now validated against
`aether.syncContext.named.redisson.allowInsecureAddress`.
- If an insecure remote address is encountered and the system property is
not set, Resolver refuses the connection with an `IllegalStateException`. If
opted in, a warning is logged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
