apache / apache/maven-help-plugin
EffectiveSettingsMojo.copySettings() does not deep-copy profiles
- Dominant language
- Java
- Stars
- 29
- Forks
- 42
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 6
Description
In src/main/java/org/apache/maven/plugins/help/EffectiveSettingsMojo.java:156-198:
Only servers and proxies are manually deep-copied. The profiles list is shared with the original via the shallow SettingsUtils.copySettings(). Profiles can contain sensitive data (passwords in properties) that would be exposed if the original settings object is later queried expecting the copy to be isolated.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start in src/main/java/org/apache/maven/plugins/help/EffectiveSettingsMojo.java:156-198 and inspect how SettingsUtils.copySettings() handles profiles compared with servers and proxies. Verify that the copied settings no longer shares profiles or their sensitive properties with the original; done means profile data remains isolated after the original settings object is queried or changed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, tooling
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 75/100