search

clj-holmes / clj-watson

clojure deps SCA
Eclipse Public License 2.0
82 stars 8 forks source link

Limit CLJ_WATSON_* env vars to known properties? #110

Open seancorfield opened 2 months ago

seancorfield commented 2 months ago

As implemented, the CLJ_WATSON_* env var machinery could be used to set any Java system property that isn't already specified on the command-line.

Should we limit this to only properties that DC core knows about? That would mean reading dependencycheck.properties from the classpath and using those core properties as a check list.

Concern: not all core properties need be listed in that file -- I suspect some optional ones are omitted so it would be impossible to override those via env vars if we added this check. Does that matter?

lread commented 2 months ago

Concern: not all core properties need be listed in that file -- I suspect some optional ones are omitted so it would be impossible to override those via env vars if we added this check. Does that matter?

Good question, but I don't think it matters.