Skip to content

Restrict Maven package file types

Problem

A user could use the Maven upload endpoints to upload files of any type. This presents an unnecessary security vulnerability.

Solution

We should restrict files uploaded to this endpoint to only allow for .xml, .pom. and .jar files. It should be double checked that these are the only file types Maven allows and update to include any other filetypes that may be allowed.

References

Investigation of package limits