[MNG-4459] [regression] Effective settings as visible to plugins contain plain text passwords

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0-alpha-4
• Fix Version/s: 3.0-alpha-5
• Component/s: Settings
• Assignee: Benjamin Bentmann
• Reporter: Benjamin Bentmann
• Created: 20/Nov/09 07:37
• Updated: 20/Nov/09 08:41
• Resolved: 20/Nov/09 08:41

Description

When we introduced MNG-553, the passwords were only decrypted at the transport layer and the Settings instance kept in memory was kept encrypted. E.g. to save plugins from accidentally dumping the plain text passwords on the console or such.

This does currently not hold for 3.0-alpha-4 as org.apache.maven.plugin:maven-help-plugin:2.0:effective-settings shows.

Issue Links

• is related to: MNG-553 Secure Storage of Server Passwords