gnodet opened a new issue, #13146: URL: https://github.com/apache/maven/issues/13146
## Problem When a dependency POM contributes a repository through a JDK/OS/`activeByDefault`-activated profile (the legitimate path, see #13100 / #13116 / #13141), that repository can declare a URL that shadows `central` or another well-known repository with a different (potentially malicious) URL. Maven currently has no defense against this: the repository is accepted as-is and used for artifact resolution. ## Proposed Solution Implement a WARN (or optionally FAIL with a flag) policy that triggers when: - A repository contributed by an external-model profile has the same `<id>` as a repository already registered in the effective repository list (e.g. `central`), but a different URL. This is a repository URL-mismatch check, scoped to the dependency resolution path. ## Non-goals - This issue does **not** revert the fix in #13100 / #13116 / #13141. The blanket stripping was over-broad. - The check should apply only when a conflict is detected, not as a general ban on external-model profile repositories. ## Notes - Discussed in #13100 and deferred from #13141 (forward-port of #13116 to master). - A `// TODO(#428)` marker has been added at the relevant call site in `DefaultModelBuilder` as a reminder. - The redefinition concern is orthogonal to the activation fix and should be addressed as a separate hardening item. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
