arturobernalg opened a new pull request, #13642: URL: https://github.com/apache/maven/pull/13642
Backport of #13496 (fix #8320 / MNG-7132), already backported to maven-4.0.x (#13525) and maven-3.10.x (#13526) but missing on maven-3.9.x, which has the same unpatched isLocal(String) in DefaultMirrorSelector and MavenRepositorySystem. A mirrorOf rule of external:* or external:http:* only treated "localhost" and "127.0.0.1" as local, so it incorrectly applied to a local repository reachable through any other loopback address, for instance 127.0.0.2, [::1] or an IPv4-mapped IPv6 loopback address. isLocal now also recognizes the whole 127.0.0.0/8 range and an IPv6 loopback address in brackets, parsed without any name lookup. Fixes #8320 ### What Backports the fix for #8320 (MNG-7132) to maven-3.9.x: `mirrorOf=external:*`/`external:http:*` rules only treated `localhost` and `127.0.0.1` as local, so they incorrectly applied to a repository reachable through any other loopback address. ### How - Same fix as #13525/#13526: `isLocal(String)` in both `DefaultMirrorSelector` (maven-compat) and `MavenRepositorySystem` (maven-core) now also matches the whole `127.0.0.0/8` range via a regex, and an IPv6 loopback address in brackets via `InetAddress.getByName` on the literal (no name resolution, so no network access or DNS lookup). - `maven-3.9.x` has the identical, unpatched `isLocal` in both classes, so this is a direct, mechanical port of the same change. - `MavenRepositorySystemTest` didn't exist yet on this branch (new in the original fix), so I created it; `DefaultMirrorSelectorTest` already existed and got the same two new test methods as upstream. ### Tests - Reproduced first: ran the new tests against the unpatched 3.9.x code — `testLoopbackAddressesAreLocal` fails (e.g. `http://127.0.0.2/m2/` ==> expected false but was true), confirming the bug. - With the fix: `mvn -pl maven-compat,maven-core test`: all tests pass (133 in the combined run, 0 failures). - `checkstyle:check` and `spotless:check`: 0 violations on both modules. --- To make clear that you license your contribution under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0) check one of the following: - [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](https://www.apache.org/licenses/LICENSE-2.0) - [x] I hereby declare that I have filed an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
