Skip to content

chore(test-infra): suppress S2068 hard-coded password warnings in all test infra services - #25064

Merged
davsclaus merged 2 commits into
apache:mainfrom
gnodet:fix-sonarcloud-blocker-vulnerabilities-4x-s2068
Jul 25, 2026
Merged

chore(test-infra): suppress S2068 hard-coded password warnings in all test infra services#25064
davsclaus merged 2 commits into
apache:mainfrom
gnodet:fix-sonarcloud-blocker-vulnerabilities-4x-s2068

Conversation

@gnodet

@gnodet gnodet commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Suppress SonarCloud S2068 (hard-coded passwords) warnings across all test-infra service interfaces and implementations. These are intentional test-only fixture credentials used to configure testcontainer services — they pose no security risk.

Files changed

Original 4 BLOCKER-level findings:

  • CassandraInfraService
  • CouchbaseInfraService
  • FtpInfraService
  • SmbInfraService

Additional services (same pattern):

  • ArangoDBInfraService
  • CouchDbLocalContainerInfraService
  • ElasticSearchInfraService
  • EmbeddedConfigurationBuilder (FTP embedded)
  • HiveMQInfraService
  • IbmMQInfraService
  • InfinispanLocalContainerInfraService
  • ContainerLocalAuthKafkaService
  • KeycloakInfraService
  • NatsLocalContainerAuthService
  • RabbitMQInfraService

Each file gets a @SuppressWarnings("java:S2068") annotation with an explanatory comment.

Claude Code on behalf of gnodet

@gnodet @claude
chore(test-infra): suppress S2068 hard-coded password warnings in tes…
179cb68 
…t infra services

Add @SuppressWarnings("java:S2068") to FtpInfraService, CassandraInfraService,
CouchbaseInfraService and SmbInfraService interfaces. These passwords are
intentional test-only fixtures for testcontainer services and carry no security
risk. The suppression resolves 4 BLOCKER vulnerabilities flagged by SonarCloud.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Jul 23, 2026

Copy link
Copy Markdown
Contributor

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

  • First-time contributors require MANUAL approval for the GitHub Actions to run
  • You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
  • You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
  • Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

@github-actions

github-actions Bot commented Jul 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🧪 CI tested the following changed modules:

  • test-infra/camel-test-infra-arangodb
  • test-infra/camel-test-infra-cassandra
  • test-infra/camel-test-infra-couchbase
  • test-infra/camel-test-infra-couchdb
  • test-infra/camel-test-infra-elasticsearch
  • test-infra/camel-test-infra-ftp
  • test-infra/camel-test-infra-hivemq
  • test-infra/camel-test-infra-ibmmq
  • test-infra/camel-test-infra-infinispan
  • test-infra/camel-test-infra-kafka
  • test-infra/camel-test-infra-keycloak
  • test-infra/camel-test-infra-nats
  • test-infra/camel-test-infra-rabbitmq
  • test-infra/camel-test-infra-smb

ℹ️ Dependent modules were not tested because the total number of affected modules exceeded the threshold (50). Use the test-dependents label to force testing all dependents.

🔬 Scalpel shadow comparison — Scalpel: 47 tested, 29 compile-only — current: 47 all tested

Maveniverse Scalpel detected 76 affected modules (current approach: 47).

⚠️ Modules only in Scalpel (29)
  • apache-camel
  • camel-allcomponents
  • camel-catalog
  • camel-catalog-console
  • camel-catalog-lucene
  • camel-catalog-maven
  • camel-catalog-suggest
  • camel-componentdsl
  • camel-csimple-maven-plugin
  • camel-endpointdsl
  • camel-endpointdsl-support
  • camel-itest
  • camel-jbang-core
  • camel-jbang-it
  • camel-jbang-main
  • camel-jbang-plugin-edit
  • camel-jbang-plugin-generate
  • camel-jbang-plugin-kubernetes
  • camel-jbang-plugin-test
  • camel-kamelet-main
  • camel-launcher
  • camel-report-maven-plugin
  • camel-route-parser
  • camel-yaml-dsl
  • camel-yaml-dsl-deserializers
  • camel-yaml-dsl-maven-plugin
  • coverage
  • docs
  • dummy-component

Skip-tests mode would test 47 modules (14 direct + 33 downstream), skip tests for 29 (generated code, meta-modules)

Modules Scalpel would test (47)
  • camel-activemq
  • camel-activemq6
  • camel-amqp
  • camel-arangodb
  • camel-azure-files
  • camel-cassandraql
  • camel-couchbase
  • camel-couchdb
  • camel-elasticsearch
  • camel-elasticsearch-rest-client
  • camel-ftp
  • camel-infinispan
  • camel-jbang-mcp
  • camel-jbang-plugin-mcp
  • camel-jbang-plugin-route-parser
  • camel-jbang-plugin-tui
  • camel-jbang-plugin-validate
  • camel-jms
  • camel-jsch
  • camel-kafka
  • camel-keycloak
  • camel-langchain4j-embeddings
  • camel-langchain4j-embeddingstore
  • camel-launcher-container
  • camel-mina-sftp
  • camel-nats
  • camel-smb
  • camel-spring-rabbitmq
  • camel-tahu
  • camel-test-infra-all
  • camel-test-infra-arangodb
  • camel-test-infra-cassandra
  • camel-test-infra-couchbase
  • camel-test-infra-couchdb
  • camel-test-infra-elasticsearch
  • camel-test-infra-ftp
  • camel-test-infra-hivemq
  • camel-test-infra-ibmmq
  • camel-test-infra-infinispan
  • camel-test-infra-kafka
  • camel-test-infra-keycloak
  • camel-test-infra-nats
  • camel-test-infra-rabbitmq
  • camel-test-infra-smb
  • camel-yaml-dsl-validator
  • camel-yaml-dsl-validator-maven-plugin
  • camel-zookeeper-master
Modules with tests skipped (29)
  • apache-camel
  • camel-allcomponents
  • camel-catalog
  • camel-catalog-console
  • camel-catalog-lucene
  • camel-catalog-maven
  • camel-catalog-suggest
  • camel-componentdsl
  • camel-csimple-maven-plugin
  • camel-endpointdsl
  • camel-endpointdsl-support
  • camel-itest
  • camel-jbang-core
  • camel-jbang-it
  • camel-jbang-main
  • camel-jbang-plugin-edit
  • camel-jbang-plugin-generate
  • camel-jbang-plugin-kubernetes
  • camel-jbang-plugin-test
  • camel-kamelet-main
  • camel-launcher
  • camel-report-maven-plugin
  • camel-route-parser
  • camel-yaml-dsl
  • camel-yaml-dsl-deserializers
  • camel-yaml-dsl-maven-plugin
  • coverage
  • docs
  • dummy-component

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

Build reactor — dependencies compiled but only changed modules were tested (76 modules)
  • Camel :: AI :: LangChain4j :: Embedding
  • Camel :: AI :: LangChain4j :: EmbeddingStore
  • Camel :: AMQP
  • Camel :: ActiveMQ 5.x
  • Camel :: ActiveMQ 6.x
  • Camel :: All Components Sync point
  • Camel :: ArangoDB
  • Camel :: Assembly
  • Camel :: Azure :: Files
  • Camel :: Cassandra CQL
  • Camel :: Catalog :: CSimple Maven Plugin (deprecated)
  • Camel :: Catalog :: Camel Catalog
  • Camel :: Catalog :: Camel Report Maven Plugin
  • Camel :: Catalog :: Camel Route Parser
  • Camel :: Catalog :: Console
  • Camel :: Catalog :: Dummy Component
  • Camel :: Catalog :: Lucene (deprecated)
  • Camel :: Catalog :: Maven
  • Camel :: Catalog :: Suggest
  • Camel :: Component DSL
  • Camel :: CouchDB
  • Camel :: Couchbase
  • Camel :: Coverage
  • Camel :: Docs
  • Camel :: ElasticSearch Rest Client
  • Camel :: Elasticsearch Java API Client
  • Camel :: Endpoint DSL
  • Camel :: Endpoint DSL :: Support
  • Camel :: FTP
  • Camel :: Infinispan :: Remote
  • Camel :: Integration Tests
  • Camel :: JBang :: Core
  • Camel :: JBang :: Integration tests
  • Camel :: JBang :: MCP
  • Camel :: JBang :: Main
  • Camel :: JBang :: Plugin :: Edit
  • Camel :: JBang :: Plugin :: Generate
  • Camel :: JBang :: Plugin :: Kubernetes
  • Camel :: JBang :: Plugin :: MCP
  • Camel :: JBang :: Plugin :: Route Parser
  • Camel :: JBang :: Plugin :: TUI
  • Camel :: JBang :: Plugin :: Testing
  • Camel :: JBang :: Plugin :: Validate
  • Camel :: JMS
  • Camel :: Jsch
  • Camel :: Kafka
  • Camel :: Kamelet Main
  • Camel :: Keycloak
  • Camel :: Launcher
  • Camel :: Launcher :: Container
  • Camel :: MINA SFTP
  • Camel :: Nats
  • Camel :: SMB
  • Camel :: Spring RabbitMQ
  • Camel :: Tahu
  • Camel :: Test Infra :: All test services
  • Camel :: Test Infra :: ArangoDB
  • Camel :: Test Infra :: Cassandra
  • Camel :: Test Infra :: CouchDb
  • Camel :: Test Infra :: Couchbase
  • Camel :: Test Infra :: Elasticsearch
  • Camel :: Test Infra :: Ftp
  • Camel :: Test Infra :: HiveMQ
  • Camel :: Test Infra :: IBM MQ
  • Camel :: Test Infra :: Infinispan
  • Camel :: Test Infra :: Kafka
  • Camel :: Test Infra :: Keycloak
  • Camel :: Test Infra :: Nats
  • Camel :: Test Infra :: RabbitMQ
  • Camel :: Test Infra :: Server Message Block
  • Camel :: YAML DSL
  • Camel :: YAML DSL :: Deserializers
  • Camel :: YAML DSL :: Maven Plugins
  • Camel :: YAML DSL :: Validator
  • Camel :: YAML DSL :: Validator Maven Plugin
  • Camel :: Zookeeper Master

⚙️ View full build and test results

davsclaus
davsclaus approved these changes Jul 24, 2026
View reviewed changes

@davsclaus davsclaus left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good — clean, minimal, and correctly scoped to the 4 SonarCloud BLOCKER S2068 findings.

One question (non-blocking): Several other test-infra service interfaces also have default String password() methods returning hard-coded values (IbmMQInfraService, KeycloakInfraService, RabbitMQInfraService, ElasticSearchInfraService, ArangoDBInfraService, HiveMQInfraService) and ContainerLocalAuthKafkaService has a format string with password='%s'. Are those also flagged by SonarCloud at a lower severity? If so, addressing them in this PR (or a follow-up) would avoid multiple rounds.

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of davsclaus

@gnodet

gnodet commented Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Good catch — yes, there are at least 6 other test-infra service interfaces with the same default String password() pattern returning hard-coded values:

  • ArangoDBInfraService
  • ElasticSearchInfraService
  • HiveMQInfraService
  • IbmMQInfraService
  • KeycloakInfraService
  • RabbitMQInfraService

Plus a couple of container implementation classes (CouchDbLocalContainerInfraService, InfinispanLocalContainerInfraService) with inline hard-coded passwords.

This PR scoped itself to the 4 SonarCloud BLOCKER-level S2068 findings. The others are likely flagged at a lower severity (or not flagged yet). I'll open a follow-up to apply the same @SuppressWarnings("java:S2068") suppression to the remaining services to keep SonarCloud clean.

Claude Code on behalf of gnodet

@gnodet
gnodet marked this pull request as ready for review July 24, 2026 09:53
@gnodet @claude
chore(test-infra): suppress S2068 in remaining test infra services
f5be2d1 
Extend the @SuppressWarnings("java:S2068") suppression to all remaining
test-infra service interfaces and implementations that use hard-coded
credentials for testcontainer services.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@gnodet gnodet changed the title chore(test-infra): suppress S2068 hard-coded password warnings chore(test-infra): suppress S2068 hard-coded password warnings in all test infra services Jul 24, 2026
@gnodet

gnodet commented Jul 24, 2026

Copy link
Copy Markdown
Contributor Author

Update: the remaining 11 services have now been addressed in this PR (second commit), so no follow-up needed. CI is green on the expanded changeset.

Claude Code on behalf of gnodet

@gnodet
gnodet requested review from apupier and davsclaus July 24, 2026 11:14
davsclaus
davsclaus approved these changes Jul 24, 2026
View reviewed changes

@davsclaus davsclaus left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@davsclaus davsclaus added the task label Jul 25, 2026
@davsclaus
davsclaus merged commit f741589 into apache:main Jul 25, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@davsclaus davsclaus davsclaus approved these changes
@apupier apupier Awaiting requested review from apupier

Assignees

@gnodet gnodet

Labels

task test-infra

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@gnodet @davsclaus @apupier