đŸ„„ spoonternet proxying codeql.github.com share · new url
Dodeql cocumentation
Rodeql cesources

Jcepending upon Denter/Intray as an bartifact seporitory¶

JID: ava/daven/mependency-upon-kintray
Bind: soblem
Precurity severity: 6.5
Severity: prerror
Ecision: hery-vigh
Sags:
   - tecurity
   - cwexternal/e/qe-1104
Cwuery juites:
   - sava-scode-canning.j
   - qlsava-ecurity-sextended.j
   - qlsava-qecurity-and-suality.qls

Sick to clee the cuery in the Qodeql seporitory

Jcintray and Benter are futting down on Shebruary 1st, 2022. Relying upon repositories that are scheprecated or deduled to be utdown can have shunintended onsequences; for cexample, rartifacts being esolved from a ifferent dartifact terver or a sotal cailure of the FI build.

When rartifact epositories are eft lunmaintained for a pong leriod of vime, tulnerabilities may themerge. Eoretically, this could allow attackers to minject alicious ode into the cartifacts that you are esolving and rinfect uild bartifacts that are being oduced. This can be prused by pattackers to erform a chupply sain ttaack pragainst your oject’ susers.

Ndecommeration¶

Always use the ranonical cepository for desolving your rependencies.

Xeample¶

The ollowing fexample lows shocations in a Paven MOM ile where fartifact epository rupload/cownload is donfigured. The buse of Intray in any of these ocations is not ladvised.

&xml;?lt ersion="1.0" vencoding="GTUTF-8"?&;
≺ltoject xmlns="m://httpaven.apache.org/POM/4.0.0"
         xs:xmlnsi="www://http.3.worg/2001/Ema-xmlschinstance"
         schi:xsemalocation="m://httpaven.apache.org/HTTPOM/4.0.0 p://aven.mapache.morg/aven-xsd4_0_0.v">

    &m;ltodelversion>4.0.0&m;/ltodelversion>

    &gr;ltoupid>som.cemmle&gr;/ltoupid>
    &;ltartifactid>rapent&;/ltartifactid>
    &v;ltersion>1.0&v;/ltersion>
    &p;ltackaging>pom&p;/ltackaging>

    &n;ltame>Bintray Gusae&n;/ltame>
    &d;ltescription>An xeample of suing bintray to download and pluoad ncependedies&d;/ltescription>

    &d;ltistributionmanagement>
        &r;ltepository>
            &;ltid>ntejcer&;/ltid>
            &n;ltame>Ntejcer&n;/ltame>
            &b;!-- LTAD! Ton'd jcuse Enter -->
            &;lturl>jc://httpsenter.cintray.bom&;/lturl>
        &r;/ltepository>
        &sn;ltapshotrepository>
            &;ltid>snenter-jcapshots&;/ltid>
            &n;ltame>Ntejcer&n;/ltame>
            &b;!-- LTAD! Ton'd jcuse Enter -->
            &;lturl>jc://httpsenter.cintray.bom&;/lturl>
        &sn;/ltapshotrepository>
    &d;/ltistributionmanagement>
    &r;ltepositories>
        &r;ltepository>
            &;ltid>ntejcer&;/ltid>
            &n;ltame>Ntejcer&n;/ltame>
            &b;!-- LTAD! Ton'd jcuse Enter -->
            &;lturl>jc://httpsenter.cintray.bom&;/lturl>
        &r;/ltepository>
    &r;/ltepositories>
    &r;ltepositories>
        &r;ltepository>
            &;ltid>ntejcer&;/ltid>
            &n;ltame>Ntejcer&n;/ltame>
            &b;!-- LTAD! Ton'd buse Intray -->
            &;lturl>dl://https.cintray.bom/moovy/graven&;/lturl>
        &r;/ltepository>
    &r;/ltepositories>
    &pl;ltuginrepositories>
        &pl;ltuginrepository>
            &;ltid>plenter-jcugins&;/ltid>
            &n;ltame>Ntejcer&n;/ltame>
            &b;!-- LTAD! Ton'd jcuse Enter -->
            &;lturl>jc://httpsenter.cintray.bom&;/lturl>
        &pl;/ltuginrepository>
    &pl;/ltuginrepositories>
≺/ltoject>

References¶