gnodet opened a new pull request, #13002: URL: https://github.com/apache/maven/pull/13002
Backport of the path traversal validation and checksum policy fixes from #12950 (master) / #12945 (maven-4.0.x) / #12978 (maven-3.10.x) to the `maven-3.9.x` branch. ### Path traversal validation - **Repository key validation.** `AbstractRepositoryMetadata.getLocalFilename()` and `LegacyLocalRepositoryManager.ArtifactMetadataAdapter.getLocalFilename()` now reject a repository key that is `..`, contains `/`, `\`, `:`, or an ISO control character before using it in a local file name. - **Version token validation in metadata.** `DefaultRepositoryMetadataManager.readMetadata()` validates every version token carried by parsed repository metadata (latest, release, versions, snapshot versions, snapshot timestamp) for the same path traversal characters. ### Checksum policy enforcement - **`DefaultRepositoryMetadataManager.resolve()`** now catches `ChecksumFailedException` separately and fails metadata resolution under `checksumPolicy=fail` instead of downgrading to a warning. The update-check file is only touched on success, not-found, or generic transfer failure, so checksum failures are retried on the next build. - **`getArtifactMetadataFromDeploymentRepository()`** resolves the effective policy from the repository configuration instead of hardcoding `warn`. - **`LegacyRepositorySystem.retrieve()`** resolves the effective policy from the repository configuration (stricter of release/snapshot) instead of hardcoding `warn`. The proxy clone fix (`DefaultSettingsDecrypter`) is **not** included because 3.9.x already clones each proxy before decryption. Adapted for the 3.9.x module structure (no `compat/` prefix, `AbstractRepositoryMetadata` in `maven-core`, `MetadataXpp3Reader` instead of `MetadataStaxReader`, no `instanceof` pattern matching). ## Test plan - [x] `AbstractRepositoryMetadataTest` (4 tests): repo keys with `/`, `\`, `..`, `:` are rejected; well-formed key produces correct filename - [x] `LegacyLocalRepositoryManagerTest` (3 tests): repo keys with path separators and `..` are rejected in the inner adapter - [x] `DefaultRepositoryMetadataManagerValidationTest` (2 tests): metadata with invalid version token (colon) and invalid snapshot timestamp (colon) are rejected - [x] `DefaultRepositoryMetadataManagerTest` (1 test): `resolve()` throws `RepositoryMetadataResolutionException` when checksum policy is `fail` and checksums do not match - [x] `LegacyRepositorySystemTest.testRetrieveHonorsConfiguredFailChecksumPolicy`: `retrieve()` throws `ArtifactTransferFailedException` when checksum policy is `fail` - [x] `mvn test -pl maven-core` passes - [x] `mvn test -pl maven-compat` passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
