Project

General

Profile

Feature #11411

[SECURITY] Pin internal and commercial artifacts to goldencode repo to prevent dependency-confusion

Added by Hynek Cihlar 3 months ago. Updated 3 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Start date:
Due date:
% Done:

0%

billable:
No
vendor_id:
GCD
case_num:
version_reported:
version_resolved:
reviewer:
production:
No
env_name:
topics:

History

#1 Updated by Hynek Cihlar 3 months ago

Both build.gradle and ext/sheet/build.gradle declare mavenCentral() alongside the goldencode maven repo with no exclusiveContent block or content { includeGroup ... } filter. Any group hosted on the goldencode artifact server can therefore be shadowed by a higher-versioned artifact published to Maven Central under the same coordinates.

Affected groups/artifacts

A quick scan resolved from https://proj.goldencode.com/artifacts/:

com.goldencode:fwd-keikai-bridge (ext/sheet)
com.goldencode:fwd-h2 (root build, fwdConvertServer)
io.keikai:keikai, keikai-model, keikai-ex, keikai-pdf, poi (commercial Keikai 6.3.0)
org.zkoss.chart:zkcharts (commercial)
org.zkoss.zk:zkmax, zkex (commercial ZK EE)

Find out if there are others.

Fix

Wrap the goldencode maven repo in an exclusiveContent block in both build.gradle and
ext/sheet/build.gradle, and list each group/module that is exclusively served from
the goldencode artifact server. The two filters must be kept in sync if the dependency
set on either side changes.

Also available in: Atom PDF