stevespringett / nist-data-mirror

A simple Java command-line utility to mirror the CVE JSON data from NIST.
Apache License 2.0
206 stars 93 forks source link

Insufficient validation of proxy settings #41

Closed ghost closed 5 years ago

ghost commented 5 years ago

The check for proxy system properties is not sufficient. There should not only be a null check but also a check for empty strings:

https://github.com/stevespringett/nist-data-mirror/blob/5e5ef4ad779d74820bdd250d0dc00c691128e4e2/src/main/java/us/springett/nistdatamirror/NistDataMirror.java#L96

This is because in the mirror.sh script which is executed in the Docker environment the proxy properties are always being set. In case no proxy_hostor proxy_port environment variable is set the http.proxyHost or http.proxyPort JVM properties are set to an empty string:

https://github.com/stevespringett/nist-data-mirror/blob/5e5ef4ad779d74820bdd250d0dc00c691128e4e2/src/docker/scripts/mirror.sh#L3

stevespringett commented 5 years ago

Released in v1.4.0