elharo opened a new issue, #242:
URL: https://github.com/apache/maven-artifact-plugin/issues/242
`AbstractBuildinfoMojo.relative(File)` (lines 452-457) computes a relative
path with naive string prefix-stripping instead of `Path.relativize`:
```java
protected String relative(File file) {
File basedir = session.getTopLevelProject().getBasedir();
int length = basedir.getPath().length();
String path = file.getPath();
return path.substring(length + 1);
}
```
Problems:
- It does not verify the file is actually below `basedir`. For
`basedir=/a/b` and `file=/a/bc/d` it silently returns `d` instead of `../bc/d`.
- It throws `StringIndexOutOfBoundsException` for paths shorter than
`basedir` (e.g. when `basedir` is `/`).
- It ignores path separators/casing on Windows.
This method feeds every "saved to ...", diffoscope, and wget hint in logs,
so misleading output is likely.
Related: line 327
(`aggregate.getName().substring(aggregate.getName().lastIndexOf('.'))`) throws
the same exception if the filename has no dot.
Suggested fix: use `basedir.toPath().relativize(file.toPath())`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
