Uploaded image for project: 'SonarQube'
  1. SonarQube
  2. SONAR-12186

Fix sensitive info stored in scanner context

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 7.9
    • Component/s: Scanner
    • Edition:
      Community
    • Production Notes:
      None

      Description

      When DEBUG logging activated for the scanner on the CI side (ex: mvn -x), all environment variables are stored in the scanner context. This context can then expose sensitive information to the SonarQube users who have access to the background tasks (SonarQube global/projects administrators).

       

      We decided to not store any longer any environment variable in the scanner context.

        Attachments

          Activity

            People

            Assignee:
            michal.duda Michal Duda (Inactive)
            Reporter:
            christophe.levis Christophe Levis
            Votes:
            0 Vote for this issue
            Watchers:
            6 Start watching this issue

              Dates

              Due:
              Created:
              Updated:
              Resolved: