[MWRAPPER-50] Verify checksum when downloading maven-wrapper.jar

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.1.0
• Fix Version/s: waiting-for-feedback
• Component/s: Maven Wrapper Scripts
• Assignee: Unassigned
• Reporter: Premek Vyhnal
• Created: 04/Jan/22 22:56
• Updated: 09/Feb/24 14:55

Description

Hi,

Sorry if I just cannot find it

but it seems the checksum is not checked of the `maven-wrapper.jar` downloaded here:

https://github.com/apache/maven-wrapper/blob/efba2bde13feeabfb42e9dc120e8a35c127baf0d/maven-wrapper-distribution/src/resources/mvnw#L207

 

Checksum of the downloaded file should be checked before executing it to avoid a remote code execution attack on the developer machine.

 

Issue Links

• is related to: MWRAPPER-79 Automatically add sha256 to maven-wrapper.properties
• is related to: MWRAPPER-75 Allow for sha256 checksum verification of downloaded artifacts.