[
https://issues.apache.org/jira/browse/NUTCH-3192?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18100069#comment-18100069
]
Hudson commented on NUTCH-3192:
-------------------------------
SUCCESS: Integrated in Jenkins build Nutch » Nutch-trunk #256 (See
[https://ci-builds.apache.org/job/Nutch/job/Nutch-trunk/256/])
NUTCH-3192 Address Yetus detsecrets/blanks and SonarCloud security findings in
config templates and DummySSL (#944) (github:
[https://github.com/apache/nutch/commit/f8a072fa1c72fc841ab32e783722dc502ea3d633])
* (edit)
src/plugin/protocol-httpclient/src/java/org/apache/nutch/protocol/httpclient/DummySSLProtocolSocketFactory.java
* (edit) conf/index-writers.xml.template
* (edit) conf/nutch-default.xml
* (edit) .markdownlint.yaml
* (edit) src/plugin/indexer-rabbit/README.md
* (edit) conf/httpclient-auth.xml.template
> Address Yetus detsecrets/blanks and SonarCloud security findings in config
> templates and DummySSL
> -------------------------------------------------------------------------------------------------
>
> Key: NUTCH-3192
> URL: https://issues.apache.org/jira/browse/NUTCH-3192
> Project: Nutch
> Issue Type: Improvement
> Components: ci/cd, security
> Affects Versions: 1.22
> Reporter: Lewis John McGibbney
> Assignee: Lewis John McGibbney
> Priority: Major
> Fix For: 1.23
>
>
> Yetus and SonarCloud report several security / style findings that are
> largely scanner noise or weak-protocol defaults rather than real credential
> leaks:
>
> *Yetus*
> * conf/index-writers.xml.template: detsecrets on RabbitMQ default
> amqp://guest:guest@localhost:5672/
> * conf/httpclient-auth.xml.template: trailing blanks; detsecrets on
> docstring example passwords
>
> *SonarCloud (apache_nutch)*
> * secrets:S6736 on RabbitIndexWriter password-masking regex (false positive;
> not a hardcoded secret)
> * java:S4423 on DummySSLProtocolSocketFactory using
> SSLContext.getInstance("SSL")
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
