elharo opened a new issue, #274:
URL: https://github.com/apache/maven-remote-resources-plugin/issues/274

   ## Summary
   The SCM-path normalization in `ModelInheritanceAssembler` has edge-case 
inaccuracies.
   
   
`src/main/java/org/apache/maven/plugin/resources/remote/ModelInheritanceAssembler.java:548-616`
   
   ```java
   protected String appendPath(String parentPath, String childPath, String 
pathAdjustment, boolean appendPaths) {
       ...
       return cleanedPath + resolvePath(uncleanPath);
   }
   
   private static String resolvePath(String uncleanPath) {
       LinkedList<String> pathElements = new LinkedList<>();
       StringTokenizer tokenizer = new StringTokenizer(uncleanPath, "/");
       while (tokenizer.hasMoreTokens()) {
           String token = tokenizer.nextToken();
           switch (token) {
               case "": break;
               case "..":
                   if (pathElements.isEmpty()) {
                       // FIXME: somehow report to the user that there are too 
many '..' elements.
                       // For now, ignore the extra '..'.
                   } else {
                       pathElements.removeLast();
                   }
                   break;
               default:
                   pathElements.addLast(token);
                   break;
           }
       }
       ...
   }
   ```
   
   ## Problems
   1. Excess `..` segments are silently ignored (there is a `// FIXME` 
acknowledging this) — a parent SCM URL with too many `..` yields a path that 
does not match what the user wrote, with no warning.
   2. Trailing slashes are dropped: `http://x/repo/` + child becomes 
`http://x/repo/child` (arguably fine), but a bare `http://x/repo/` (no child) 
normalizes to `http://x/repo`, changing the URL.
   3. `""` tokens (double slashes `//`) are silently removed, which can 
collapse URLs that legitimately contain them.
   
   ## Impact
   Inherited `scm` connection/url values in supplemental models can be subtly 
wrong for unusual parent URLs, producing checkout paths that differ from the 
source repository layout.
   
   ## Suggested fix
   Move to a well-tested path normalizer (e.g. `java.nio.file.Paths`/URI 
handling, or `plexus-utils` `PathTool`) and decide explicitly how to handle 
excess `..`, trailing slashes, and empty segments; emit a warning instead of 
silently dropping path elements.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to