apache / apache/maven

[MNG-8398] mvn --encrypt[--master]--password should work with redirected streams

Open
#10,230 1 comment 0 reactions 0 assignees View on GitHub
enhancement priority:minor
Dominant language
Java
Stars
5.3k
Forks
3.1k
Avg merge
20h 42m
Merged PRs (30d)
297

Description

**[James Nord](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=jnord_cbs)** opened **[MNG-8398](https://issues.apache.org/jira/browse/MNG-8398?redirect=false)** and commented

Maven 3.2.1 provided a way to enter the password to be encrypted via interactive input for security reasons.

However the implementation uses the `java.io.Console` API with no fallback to stdin/stdout.

This makes it virtually impossible[1] to securely[2] encrypt a password from another program (for example a tool that will bootstrap a `settings.xml` for a corporate structure etc.

 

### Steps to reproduce

(to reproduce without any 3rd party tooling run, which is not how I would expect this to be called, but is here to demonstrate)

`echo n myMasterPassword |mvn -encrypt-master-password`

#### Expected results

`{base64HexString}`

#### Actual results

`{}`

 

[1] without relying on 3rd party tools that may not be installed, eg. on Linux you can use `script` (which is likely to be installed), but on windows you have no such generally available solution 

[2] without the password being showing exposed in the process list (which is why this was implemented to begin with).

---

**Affects:** 3.9.9

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.