[MNG-8398] mvn --encrypt[--master]--password should work with redirected streams
- Dominant language
- Java
- Stars
- 5.3k
- Forks
- 3.1k
- Avg merge
- 20h 42m
- Merged PRs (30d)
- 297
Description
**[James Nord](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=jnord_cbs)** opened **[MNG-8398](https://issues.apache.org/jira/browse/MNG-8398?redirect=false)** and commented
Maven 3.2.1 provided a way to enter the password to be encrypted via interactive input for security reasons.
However the implementation uses the `java.io.Console` API with no fallback to stdin/stdout.
This makes it virtually impossible[1] to securely[2] encrypt a password from another program (for example a tool that will bootstrap a `settings.xml` for a corporate structure etc.
### Steps to reproduce
(to reproduce without any 3rd party tooling run, which is not how I would expect this to be called, but is here to demonstrate)
`echo n myMasterPassword |mvn -encrypt-master-password`
#### Expected results
`{base64HexString}`
#### Actual results
`{}`
[1] without relying on 3rd party tools that may not be installed, eg. on Linux you can use `script` (which is likely to be installed), but on windows you have no such generally available solution
[2] without the password being showing exposed in the process list (which is why this was implemented to begin with).
---
**Affects:** 3.9.9
Contributor guide
Assessment
This issue has not been assessed yet.