io.codemodder.codemods.MavenSecureURLCodemod.description.md Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of core-codemods Show documentation
Show all versions of core-codemods Show documentation
Codemods for fixing common errors across many Java projects
This change replaces any HTTP URLs found in `` definitions with HTTPS URLs. Without this change, Maven will make requests to either publish or retrieve artifacts over a plaintext channel.
That plaintext channel can be [observed or modified by malicious actors](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) on the network path between the host running Maven and their intended repository. These actors could then sniff repository credentials, publish malicious artifacts, etc. Simply switching to an HTTPS URL is sufficient to make all of these attacks impossible in almost all situations.
Our changes look something like this:
```diff
...
my-release-repo
Acme Releases
- http://repo.acme.com
+ https://repo.acme.com
```