This is an automated email from the ASF dual-hosted git repository.
elharo pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/maven-archiver.git
The following commit(s) were added to refs/heads/master by this push:
new 785d928 fix: restrict `isNumeric()` to ASCII digits to prevent
`NumberFormatExceptionRefactor` digit validation logic in MavenArchiver (#376)
785d928 is described below
commit 785d9283fcbe05074001b5f10405763e33e4528d
Author: Harsh Mehta <[email protected]>
AuthorDate: Thu Jul 2 20:51:53 2026 +0530
fix: restrict `isNumeric()` to ASCII digits to prevent
`NumberFormatExceptionRefactor` digit validation logic in MavenArchiver (#376)
* Refactor digit validation logic in MavenArchiver
Signed-off-by: Harsh Mehta <[email protected]>
* Add test for rejecting non-ASCII unicode digits in timestamp parsing
Signed-off-by: Harsh Mehta <[email protected]>
---------
Signed-off-by: Harsh Mehta <[email protected]>
---
.../apache/maven/shared/archiver/MavenArchiver.java | 2 +-
.../maven/shared/archiver/MavenArchiverTest.java | 20 ++++++++++++++++++++
2 files changed, 21 insertions(+), 1 deletion(-)
diff --git a/src/main/java/org/apache/maven/shared/archiver/MavenArchiver.java
b/src/main/java/org/apache/maven/shared/archiver/MavenArchiver.java
index 7ab7740..cbab812 100644
--- a/src/main/java/org/apache/maven/shared/archiver/MavenArchiver.java
+++ b/src/main/java/org/apache/maven/shared/archiver/MavenArchiver.java
@@ -717,7 +717,7 @@ public class MavenArchiver {
}
for (char c : str.toCharArray()) {
- if (!Character.isDigit(c)) {
+ if (c < '0' || c > '9') {
return false;
}
}
diff --git
a/src/test/java/org/apache/maven/shared/archiver/MavenArchiverTest.java
b/src/test/java/org/apache/maven/shared/archiver/MavenArchiverTest.java
index 2419bda..e27b76e 100644
--- a/src/test/java/org/apache/maven/shared/archiver/MavenArchiverTest.java
+++ b/src/test/java/org/apache/maven/shared/archiver/MavenArchiverTest.java
@@ -1314,6 +1314,26 @@ class MavenArchiverTest {
.withCauseInstanceOf(DateTimeParseException.class);
}
+ @ParameterizedTest
+ @ValueSource(
+ strings = {
+ // Arabic-Indic digits (U+0660–U+0669)
+ "٠١٢٣٤٥٦٧٨٩",
+ // Bengali digits (U+09E6–U+09EF)
+ "০১২৩৪",
+ // Devanagari digits (U+0966–U+096F)
+ "०१२३४",
+ // Extended Arabic-Indic digits (U+06F0–U+06F9)
+ "۰۱۲۳۴"
+ })
+ void unicodeDigitsAreRejectedAsTimestamp(String unicodeDigits) {
+ // Character.isDigit() returns true for non-ASCII digits, but
Long.parseLong() only accepts ASCII 0-9.
+ // These must not throw NumberFormatException — they must yield IAE
with DateTimeParseException cause.
+ assertThatExceptionOfType(IllegalArgumentException.class)
+ .isThrownBy(() ->
MavenArchiver.parseBuildOutputTimestamp(unicodeDigits))
+ .withCauseInstanceOf(DateTimeParseException.class);
+ }
+
@ParameterizedTest
@CsvSource({
"2011-12-03T10:15:30+01,1322903730",
