All start.d ini parameters become viewable; non obvious
Open
Enhancement
- Dominant language
- Java
- Stars
- 4.1k
- Forks
- 2k
- Avg merge
- 3d 56m
- Merged PRs (30d)
- 48
Description
**Jetty version(s)**
Jetty 12
**Enhancement Description**
Contents of ini files in start.d turn into process parameters. It's non-obvious that settings, possibly protected by file permissions, become part of the publicly viewable process arguments. This isn't great for anything that contains a password, like start.d/ssl.ini.
It looks like it happens here: https://github.com/jetty/jetty.project/blob/dde6ae18f93a2b82e900ceb8b79210f44948e79d/jetty-home/src/main/resources/bin/jetty.sh#L571
The best solution would be for the file contents to remain hidden. At the least, ssl.ini and similar should locally document that all values become public.
Contributor guide
Assessment
This issue has not been assessed yet.