gnodet commented on PR #13450:
URL: https://github.com/apache/maven/pull/13450#issuecomment-6149178494

   Thanks for the review!
   
   **Finding 1 addressed**: `ConditionProfileActivator.doGetProperty()` calls 
`context.getModelProperty()` directly — the original sandbox only stopped model 
properties from leaking into `getSystemProperty()`, but `getModelProperty()` 
itself was still delegating to the real context. Fixed by overriding 
`getModelProperty()` to return `null` in 
`withoutUserPropertiesAndFilesystem()`, alongside `getUserProperty()`.
   
   **Finding 2 addressed**: Updated the Javadoc bullet to accurately describe 
that model properties are suppressed via `getModelProperty()` returning `null`, 
not just through the system-property lookup.
   
   **Finding 3 addressed**: Added a `pom-declared-property-via-condition` 
profile to the test fixture (`resolved-model-with-profiles.xml`) with 
`<condition>${pom.declared.prop} == 'hello'</condition>`, and added assertions:
   - `testDependencyModelActivatesOnlyEnvironmentIndependentProfiles`: 
`assertNull(profile.pom.condition)` — sandbox suppresses it
   - `testProjectBuildEvaluatesAllActivators`: `assertEquals("activated", 
profile.pom.condition)` — non-sandboxed context exposes POM properties
   
   Same fix applied to #13452 (4.0.x, which also has 
`ConditionProfileActivator`). PR #13451 (3.10.x) has no impl stack so no change 
needed there — its `PropertyProfileActivator` already only reads from 
`getUserProperties()` + `getSystemProperties()`.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to