search

uber / uReplicator

Improvement of Apache Kafka Mirrormaker
Apache License 2.0
906 stars 200 forks source link

Use HTTPS protocol to access maven repository #367

Open rng70-or opened 1 month ago

rng70-or commented 1 month ago

In file: pom.xml, HTTP protocol was used to access a maven repository. The configuration is broken and HTTPS should be used here. This may have severe security consequences.

Suggested Fix

even though this is an issue but a possible fix is suggested below,

<repositories>
    <repository>
      <id>maven-restlet</id>
      <name>Public online Restlet repository</name>
      <url>https://maven.restlet.org</url>
    </repository>
  </repositories>

Sponsorship and Support

This work is done by the security researchers from OpenRefactory and is supported by the Open Source Security Foundation (OpenSSF): Project Alpha-Omega. Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.

The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.