Zipcloud exclude folder patterns full#

“.npm/secret/**” Blocking the package secret from remote resolution. “.npm/my-*/**” Blocking packages with a my prefix from remote resolution. With that in mind, the process is similar for other packages and mostly relies on the package Blocking the scope from remote resolution. The Include/Exclude patterns are set in the repository’s Basic Configuration.īelow you will find an example for two popular packages, NPM, and Maven. In this fashion, no requests for internal packages will be made to remote repositories. The best practice would be to have all the remote repositories under a virtual repository and to specify an Exclude pattern for internal packages to that virtual repository. This can be avoided by using Exclude patterns for the remote repositories.

Zipcloud exclude folder patterns full#

In these cases, as Artifactory will not find the artifact inside the local repository, it will continue to search for it in the defined remote repositories, potentially exposing the details of the query, including the full artifact name, which may include sensitive business information.įurthermore, if an attacker obtained the internal package name, he may deploy a malicious package with the same name to a public repository.

The developer requested an internal package without specifying a version The developer has requested a snapshot with a version number that does not exist in the local repository. There is a simple typo in the requested artifact name (As it being searched via the configured remote repository aggregated by the virtual) However, consider what happens if an internal artifact is being requested via the virtual repository and unintentionally the request is directed outside the organization. Include patterns are a list of patterns to include when processing artifact requests. When using a Virtual repository that aggregates local and remote repositories, any private artifact that is deployed, is stored within a local repository and available only for authorized internal use. As the name suggests, Include/Exclude patterns are a set of Ant-like patterns in the form of x/y//z/ that can be configured on a repository level to limit the deployment, resolution, and searches of artifacts. How can I avoid security risks by using Exclude patterns?

(by default include all “**/*”)Įxclude patterns are a list of patterns to exclude when evaluating artifact requests according to the “exclude patterns” configured.

Only artifacts matching one of the “include patterns” configured are served. This is a useful feature that could help to avoid possible security risks.Īs the name suggests, Include/Exclude patterns are a set of Ant-like patterns in the form of “ x/y/**/z/*” that can be configured on a repository level to limit the deployment, resolution, and searches of artifacts. Artifactory can limit the resolution or deployment of artifacs by using the exclude/include pattern.