[FLINK-4732] Maven junction plugin security threat

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Fix Version/s: 1.1.3, 1.2.0
• Component/s: Build System
• Assignee: Maximilian Michels
• Reporter: Maximilian Michels
• Created: 04/Oct/16 09:11
• Updated: 11/Oct/16 14:34
• Resolved: 04/Oct/16 13:50

Description

We use the Maven Junction plugin http://pyx4j.com/pyx4j-maven-plugins/maven-junction-plugin/introduction.html to create a symbolic link to the build directory. On Windows, the plugin downloads an executable from the author's homepage which may be modified by an attacker. The plugin has not been updated since 2007 and the maintainer has not shown interest to fix the issue.

I propose to remove the plugin while this security threat persists.

Issue Links

• relates to: FLINK-4799 Re-add build-target symlink to project root
• links to: GitHub Pull Request #2586