gnodet opened a new pull request, #2079: URL: https://github.com/apache/maven-resolver/pull/2079
## Summary Fixes 4 findings from the maven-resolver security audit (scan-maven-resolver-20260811): | Finding | Severity | Description | |---------|----------|-------------| | f001 | **HIGH** | Leading-dot and colon coordinates bypass `validatePathComponent`: absolute-path writes outside local repo and cross-host fetches | | f003 | MEDIUM | `FileTransporter` traversal guard misses absolute paths and Windows separators | | f010 | MEDIUM | Repository id `".."` escapes origin-aware trusted-checksums and split-LRM directories | | f017 | MEDIUM | Default file-lock name mapper builds lock paths from raw wire-supplied coordinates | **Root cause:** Strings from remote repositories (artifact coordinates, repository ids) are validated in their pre-transformation shape and then passed to `Path.resolve()`, which returns absolute arguments unchanged. No sink asserts containment. **Fix:** Validate post-replacement path shape, reject `..`/`.`/`:` segments, and assert `normalize().startsWith(base)` containment at every resolve sink. ## Test plan - [ ] Existing tests pass - [ ] New test cases for leading-dot groupId, colon groupId, ".." repository id - [ ] FileTransporter containment check tested - [ ] Lock path containment tested Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
