bacec7182c91 , when dev team worked at Java Specs feature security was our main focus. There're few layers of isolation of harmful code from Bamboo Server environment:

• Docker image to execute Maven process. All downloaded dependencies are stored inside that Docker image and don't spoil .m2 repository of Bamboo Server
• Restrictive security manager used to execute Maven process: Java Specs code can't read files outside of source folder, can't execute additional processes etc
• Safe pom.xml version. Bamboo doesn't use provided by user pom.xml and copies dependencies from it to stock pom.xml bundled with Bamboo. It allows to avoid usage of unsecure settings like compiler flags or external plugins and file processors.

If you believe it's not enough secure solution please let us know what we can improve to make your organisation confident and use full power of Bamboo Java Specs.

@Alexey Chystoprudov - We cannot allow Java Spec repositories to be scanned in Bamboo Server. I am ok if it is scanned in Bamboo Agents instead. The reason users have their own Java Specs in which I see their project POMs have vulnerable versions of dependencies(ex: log4j-1.x). If we allow such scans then these vulnerable versions of jars will be installed in Bamboo Server under .m2 repository of the service account of Bamboo. The enterprise Qualys will scan regularly and will be flagged Bamboo as vulnerable.  I don't find a reason why Java Spec scan is opted to scan in Bamboo Server instead of user agents. Either we need an option to choose whether to allow or not or the scan must happens on agents not bamboo server. Right now users cannot use Java Specs since the port to maven central repo is not enabled in Bamboo server. Moreover, we have not installed Maven executable to perform such scans.

bacec7182c91 what would you setting if this feature is implemented? Can you please explain why it's important for your organization?

We need this feature to be implemented or else we need scan must happens on agents instead of Bamboo server it self.