michael-o commented on code in PR #2170:
URL: https://github.com/apache/maven/pull/2170#discussion_r2006925005
##########
impl/maven-impl/src/main/java/org/apache/maven/impl/DefaultModelXmlFactory.java:
##########
@@ -48,8 +48,37 @@
@Singleton
public class DefaultModelXmlFactory implements ModelXmlFactory {
@Override
+ @Nonnull
public Model read(@Nonnull XmlReaderRequest request) throws
XmlReaderException {
nonNull(request, "request");
+ Model model = doRead(request);
+ if (isModelVersionGreaterThan400(model)
+ &&
!model.getNamespaceUri().startsWith("http://maven.apache.org/POM/";)) {
+ throw new XmlReaderException(
+ "Invalid namespace '" + model.getNamespaceUri() + "' for
model version " + model.getModelVersion(),
+ null,
+ null);
+ }
+ return model;
+ }
+
+ private boolean isModelVersionGreaterThan400(Model model) {
+ String version = model.getModelVersion();
+ if (version == null) {
+ return false;
+ }
+ try {
+ String[] parts = version.split("\\.");
+ int major = Integer.parseInt(parts[0]);
+ int minor = parts.length > 1 ? Integer.parseInt(parts[1]) : 0;
+ return major > 4 || (major == 4 && minor > 0);
+ } catch (NumberFormatException | ArrayIndexOutOfBoundsException e) {
Review Comment:
Isn't IOOBE enough to catch?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
