jetty / jetty/jetty.project

All start.d ini parameters become viewable; non obvious

Open
#14,005 1 comment 0 reactions 1 assignee Claimed by @joakime View on GitHub
Enhancement
Dominant language
Java
Stars
4.1k
Forks
2k
Avg merge
3d 56m
Merged PRs (30d)
48

Description

**Jetty version(s)**
Jetty 12

**Enhancement Description**
Contents of ini files in start.d turn into process parameters. It's non-obvious that settings, possibly protected by file permissions, become part of the publicly viewable process arguments. This isn't great for anything that contains a password, like start.d/ssl.ini.

It looks like it happens here: https://github.com/jetty/jetty.project/blob/dde6ae18f93a2b82e900ceb8b79210f44948e79d/jetty-home/src/main/resources/bin/jetty.sh#L571

The best solution would be for the file contents to remain hidden. At the least, ssl.ini and similar should locally document that all values become public.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.