elharo opened a new issue, #140: URL: https://github.com/apache/maven-dependency-tree/issues/140
## Summary `DependencyCollectorRequest.getConfigProperties()` returns the internal backing `Map<String, String>` directly, so callers can mutate the request after construction without going through `addConfigProperty(...)`/`removeConfigProperty(...)`. If the map is later shared or reused, this breaks the encapsulation those helpers exist to provide. ## Affected code `src/main/java/org/apache/maven/shared/dependency/graph/collector/DependencyCollectorRequest.java:130-132` ## Impact - External mutation bypasses the add/remove API (and any future validation/normalization added there). - A caller holding the returned map while the request is used concurrently can observe inconsistent configuration. ## Suggested fix Return an unmodifiable copy/view from `getConfigProperties()` (e.g. `Collections.unmodifiableMap(new HashMap<>(configProperties))`) or a shallow copy, and add a test asserting the returned map cannot modify the request. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
