From 20fa38b27c2c29f3b1ccb14d628daff6e630c72a Mon Sep 17 00:00:00 2001 From: Alejandro Beiderman Date: Tue, 6 Oct 2026 13:14:08 -0700 Subject: [PATCH] Allowlist maven.configdirector.com for maven and gradle jobs maven.configdirector.com is ConfigDirector's public Maven repository for its Android and Java SDKs (group com.configdirector), whose new versions are no longer published to Maven Central. Like the vendor repositories it is listed next to, it serves anonymous downloads and returns 404 (not 401) for an absent artifact. It does not redirect artifact paths. Exact host only: other configdirector.com hosts are not registries. A child probe and a parent probe keep the entry from widening. --- internal/handlers/egress_allowlist_defaults.yaml | 1 + internal/handlers/egress_allowlist_test.go | 3 +++ 2 files changed, 4 insertions(+) diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml index a4bc650..1c4647a 100644 --- a/internal/handlers/egress_allowlist_defaults.yaml +++ b/internal/handlers/egress_allowlist_defaults.yaml @@ -339,6 +339,7 @@ ecosystem_default_domains: - maven.fullstory.com - maven.lokalise.com - repository.medallia.com + - maven.configdirector.com - jogamp.org # JCenter is retired but still 301-redirects to repo1.maven.org, which is # already allowed; only the entry point of the chain needs listing. diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go index fb87892..fbfd0c0 100644 --- a/internal/handlers/egress_allowlist_test.go +++ b/internal/handlers/egress_allowlist_test.go @@ -1323,6 +1323,7 @@ func TestEgressAllowlist_PublicRegistriesThirdWaveAllowed(t *testing.T) { "https://maven.fullstory.com/com/fullstory/gradle-plugin/maven-metadata.xml", "https://maven.lokalise.com/com/lokalise/sdk/maven-metadata.xml", "https://repository.medallia.com/artifactory/public/com/medallia/maven-metadata.xml", + "https://maven.configdirector.com/com/configdirector/server-sdk/maven-metadata.xml", "https://jogamp.org/deployment/maven/org/jogamp/gluegen/maven-metadata.xml", "https://jcenter.bintray.com/com/google/guava/guava/maven-metadata.xml", "https://salesforce-marketingcloud.github.io/MarketingCloudSDK-Android/maven-metadata.xml", @@ -1378,6 +1379,7 @@ func TestEgressAllowlist_PublicRegistriesThirdWaveAllowed(t *testing.T) { "https://evil.maven.fullstory.com/payload", "https://evil.maven.lokalise.com/payload", "https://evil.repository.medallia.com/payload", + "https://evil.maven.configdirector.com/payload", "https://evil.jogamp.org/payload", "https://evil.jcenter.bintray.com/payload", "https://evil.pkg.kzu.app/payload", @@ -1396,6 +1398,7 @@ func TestEgressAllowlist_PublicRegistriesThirdWaveAllowed(t *testing.T) { "https://fullstory.com/payload", "https://lokalise.com/payload", "https://medallia.com/payload", + "https://configdirector.com/payload", "https://essentialsx.net/payload", "https://xposed.info/payload", "https://julialang.net/payload",