[
https://issues.apache.org/jira/browse/CAMEL-23268?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18099441#comment-18099441
]
Guillaume Nodet commented on CAMEL-23268:
-----------------------------------------
This issue appears to have been already addressed on the main branch in commit
b0b6777e41f0671b45fcac9c4d823d2043318f13 by Claus Ibsen, which added a //
NOSONAR suppression to WrapperCommand.makeExecutable(). This was one of the two
acceptable resolutions explicitly stated in the issue description, and is
correct because wrapper scripts conventionally use 755 permissions.
Please verify and close if confirmed.
_Note: This comment was generated by a coding agent (Claude Code on behalf of
gnodet) and requires manual verification._
> [camel-jbang] Wrapper command potential security permission issue
> -----------------------------------------------------------------
>
> Key: CAMEL-23268
> URL: https://issues.apache.org/jira/browse/CAMEL-23268
> Project: Camel
> Issue Type: Improvement
> Components: camel-jbang
> Affects Versions: 4.19.0
> Reporter: Pasquale Congiusti
> Assignee: Guillaume Nodet
> Priority: Minor
>
> The work done in https://github.com/apache/camel/pull/21978 may have
> introduced a potential security permission problem [1]. This is setting a
> `PosixFilePermission.OTHERS_EXECUTE` which is likely a too broad permission
> allowing `OTHERS` execution permission which probably they don't need.
> Please, review it and fix. If by any change this is the correct expected
> privilege, add a comment note to exclude from sonar static code analysis.
> [1]
> https://sonarcloud.io/project/issues?impactSoftwareQualities=SECURITY&issueStatuses=OPEN%2CCONFIRMED&id=apache_camel&open=AZ0GN9CjMLjZL-UnzDjl
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
