gnodet commented on code in PR #13078:
URL: https://github.com/apache/maven/pull/13078#discussion_r3969876924
##########
maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/metadata/ValidatingMetadataXpp3Reader.java:
##########
@@ -40,33 +42,49 @@ public final class ValidatingMetadataXpp3Reader {
* Delegates to {@link MetadataXpp3Reader#read(Reader, boolean)}
*/
public Metadata read(Reader reader, boolean strict) throws IOException,
XmlPullParserException {
- return validate(mr.read(reader, strict));
+ try {
+ return validate(mr.read(reader, strict));
+ } catch (IllegalArgumentException e) {
+ throw new IOException("Invalid metadata detected: " +
e.getMessage(), e);
+ }
}
/**
* Delegates to {@link MetadataXpp3Reader#read(InputStream, boolean)}
*/
public Metadata read(InputStream in, boolean strict) throws IOException,
XmlPullParserException {
- return validate(mr.read(in, strict));
+ try {
+ return validate(mr.read(in, strict));
+ } catch (IllegalArgumentException e) {
+ throw new IOException("Invalid metadata detected: " +
e.getMessage(), e);
+ }
}
/**
* Validates {@link Metadata}.
*/
- public static Metadata validate(Metadata metadata) {
+ private static Metadata validate(Metadata metadata) {
if (metadata != null) {
PathUtils.validatePathComponent(metadata.getVersion(), "version");
+ for (Plugin plugin : metadata.getPlugins()) {
+ PathUtils.validatePathComponent(plugin.getArtifactId(),
"plugin/artifactId");
+ }
Review Comment:
@ascheman's observation is correct — `plugin.getPrefix()` validation was
present in the removed `DefaultMetadataReader.validateMetadata()` but was not
carried over here. Since prefixes are used as coordinate/path components
downstream, this should be:
```suggestion
PathUtils.validatePathComponent(plugin.getArtifactId(),
"plugin/artifactId");
PathUtils.validatePathComponent(plugin.getPrefix(),
"plugin/prefix");
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
