Repository: GoogleContainerTools/jib
File: jib-core/src/main/java/com/google/cloud/tools/jib/http/Connection.java (Java)

Code before:
  public static Function<URL, Connection> getInsecureConnectionFactory()
      throws GeneralSecurityException {
    // Do not use {@link NetHttpTransport}. See {@link getConnectionFactory} for details.
    HttpTransport transport = new ApacheHttpTransport.Builder().doNotValidateCertificate().build();
    addProxyCredentials(transport);
    return url -> new Connection(url, transport);
  }

  private static void addProxyCredentials(HttpTransport transport) {
    DefaultHttpClient httpClient =
        (DefaultHttpClient) ((ApacheHttpTransport) transport).getHttpClient();

    if (System.getProperty("http.proxyUser") != null) {
      httpClient
          .getCredentialsProvider()
          .setCredentials(
              new AuthScope(
                  System.getProperty("http.proxyHost"),
                  Integer.parseInt(System.getProperty("http.proxyPort"))),
              new UsernamePasswordCredentials(
                  System.getProperty("http.proxyUser"), System.getProperty("http.proxyPassword")));
    } else if (System.getProperty("https.proxyUser") != null) {
      httpClient
          .getCredentialsProvider()
          .setCredentials(
              new AuthScope(
                  System.getProperty("https.proxyHost"),
                  Integer.parseInt(System.getProperty("https.proxyPort"))),
              new UsernamePasswordCredentials(
                  System.getProperty("https.proxyUser"),
                  System.getProperty("https.proxyPassword")));
    }
  }

  private HttpRequestFactory requestFactory;

  @Nullable private HttpResponse httpResponse;

  /** The URL to send the request to. */
  private final GenericUrl url;

  /**
   * Make sure to wrap with a try-with-resource to ensure that the connection is closed after usage.
   *
   * @param url the url to send the request to
   */
  @VisibleForTesting
  Connection(URL url, HttpTransport transport) {
    this.url = new GenericUrl(url);
    requestFactory = transport.createRequestFactory();
  }

Review comment (security):
Question: I believe these properties (`http.proxyUser`, etc) have been working, so that makes me think we don't really need to do this (`setCredentials` and all the stuff in this method). Why do we need this all of a sudden?

Code after:
  public static Function<URL, Connection> getInsecureConnectionFactory()
      throws GeneralSecurityException {
    // Do not use {@link NetHttpTransport}. See {@link getConnectionFactory} for details.
    HttpTransport transport = new ApacheHttpTransport.Builder().doNotValidateCertificate().build();
    addProxyCredentials(transport);
    return url -> new Connection(url, transport);
  }

  /**
   * Registers proxy credentials onto transport client, in order to deal with proxies that require
   * basic authentication.
   *
   * @param transport
   */
  private static void addProxyCredentials(HttpTransport transport) {
    DefaultHttpClient httpClient =
        (DefaultHttpClient) ((ApacheHttpTransport) transport).getHttpClient();

    boolean httpProxy = System.getProperty("http.proxyHost") != null;
    boolean httpCreds =
        System.getProperty("http.proxyUser") != null
            && System.getProperty("http.proxyPassword") != null;
    if (httpProxy && httpCreds) {
      httpClient
          .getCredentialsProvider()
          .setCredentials(
              new AuthScope(
                  System.getProperty("http.proxyHost"),
                  Integer.parseInt(System.getProperty("http.proxyPort", "8080"))),
              new UsernamePasswordCredentials(
                  System.getProperty("http.proxyUser"), System.getProperty("http.proxyPassword")));
    }
    boolean httpsProxy = System.getProperty("https.proxyHost") != null;
    boolean httpsCreds =
        System.getProperty("https.proxyUser") != null
            && System.getProperty("https.proxyPassword") != null;
    if (httpsProxy && httpsCreds) {
      httpClient
          .getCredentialsProvider()
          .setCredentials(
              new AuthScope(
                  System.getProperty("https.proxyHost"),
                  Integer.parseInt(System.getProperty("https.proxyPort", "443"))),
              new UsernamePasswordCredentials(
                  System.getProperty("https.proxyUser"),
                  System.getProperty("https.proxyPassword")));
    }
  }

  private HttpRequestFactory requestFactory;