Security audit: LOW/INFO docs and minor fixes — docs refresh, jar robustness, guard, log - #700
Open
gnodet wants to merge 5 commits into
Open
Security audit: LOW/INFO docs and minor fixes — docs refresh, jar robustness, guard, log#700gnodet wants to merge 5 commits into
gnodet wants to merge 5 commits into
Conversation
gnodet
force-pushed
the
security/audit-low-robustness
branch
from
August 31, 2026 13:45
01b6a86 to
b8e8bcb
Compare
gnodet
force-pushed
the
security/audit-docs-minor
branch
3 times, most recently
from
September 1, 2026 14:43
b47521c to
7750ba9
Compare
4 tasks
… src/main before writ Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ies/finally: (1) the Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…resolves both sides t Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…th a comment explainin Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
gnodet
force-pushed
the
security/audit-docs-minor
branch
from
September 1, 2026 18:54
7750ba9 to
cdcf417
Compare
Align deploy-at-end failure reporting with install plugin PR #445: when the batch deploy fails mid-loop, log an explicit per-project inventory showing which projects were already published and which were not, instead of only reporting at the request level. Also moves the DEPLOYED state marking into the deploy loop so each project transitions TO_BE_DEPLOYED → DEPLOYED as soon as its contributing request completes, making the exactly-once guard and the partial-deploy inventory consistent. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
5 tasks
gnodet
marked this pull request as ready for review
September 1, 2026 21:16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Applies the remaining 4 LOW/INFO findings from the Glasswing static security audit (scan-maven-deploy-plugin-20260811). All confirmed TP with 5/5 adversarial-panel unanimity. Stacks on #699 (LOW robustness fixes) → #698 (MEDIUM security fixes).
Findings addressed
repositoryLayout, wagon-era examplesPath.equals-only — bypassableChanges
repositoryLayoutparameter from usage/legacy-layout pages; rewrote wagon-era transport guidance; added cleartext warning + encrypted-password example to deploy-ftp page; every new claim verified againstsrc/mainIOExceptionduring jar POM reading now WARNs; multi-POM (shaded) jars refuse coordinate auto-derivation (fail-closed); temp-POM leak fixed viapomFromJarflag;<3-chartemp prefix crash paddedtoRealPath, falling back to absolute-normalized) instead of textualPath.equals, catchingsub/../respellings and symlinksDeployMojo.java:176-178: immediate-deploy branch now logs "Deploying " instead of falsely claiming deferralTest plan
Audit source:
scan-maven-deploy-plugin-20260811.zip🤖 Generated with Claude Code