This is an automated email from the ASF dual-hosted git repository. slachiewicz pushed a commit to branch agent/pr308-on-master in repository https://gitbox.apache.org/repos/asf/maven-remote-resources-plugin.git
commit 998ac26f653a6c41842a31e48bd2dbf365875f4a Author: Efe Gökdemir <[email protected]> AuthorDate: Fri Oct 9 19:21:37 2026 +0300 fix: clarify and cache remote resource paths --- .../remote/AbstractProcessRemoteResourcesMojo.java | 15 +++++++++++---- .../plugin/resources/remote/RemoteResourcesMojoTest.java | 4 ++-- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java b/src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java index f274498..28745dd 100644 --- a/src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java +++ b/src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java @@ -121,6 +121,8 @@ import org.eclipse.aether.util.artifact.JavaScopes; */ public abstract class AbstractProcessRemoteResourcesMojo extends AbstractMojo { private static final String TEMPLATE_SUFFIX = ".vm"; + private static final String INVALID_REMOTE_RESOURCE_PATH_MESSAGE = + "Remote resource path must be relative and within the output directory: "; /** * <p> @@ -957,6 +959,7 @@ public abstract class AbstractProcessRemoteResourcesMojo extends AbstractMojo { String velocityResource = null; try { + File canonicalOutputDirectory = outputDirectory.getCanonicalFile(); for (Map.Entry<String, RemoteResourcesBundle> entry : remoteResources) { String bundleResource = entry.getKey(); @@ -973,7 +976,7 @@ public abstract class AbstractProcessRemoteResourcesMojo extends AbstractMojo { // Don't overwrite resource that are already being provided. - File outputFile = resolveOutputFile(outputDirectory, projectResource); + File outputFile = resolveOutputFile(outputDirectory, canonicalOutputDirectory, projectResource); FileUtils.mkdir(outputFile.getParentFile().getAbsolutePath()); @@ -1033,14 +1036,18 @@ public abstract class AbstractProcessRemoteResourcesMojo extends AbstractMojo { static File resolveOutputFile(File outputDirectory, String resourceName) throws IOException, MojoExecutionException { + return resolveOutputFile(outputDirectory, outputDirectory.getCanonicalFile(), resourceName); + } + + private static File resolveOutputFile(File outputDirectory, File canonicalOutputDirectory, String resourceName) + throws IOException, MojoExecutionException { if (new File(resourceName).isAbsolute()) { - throw new MojoExecutionException("Remote resource is outside the output directory: " + resourceName); + throw new MojoExecutionException(INVALID_REMOTE_RESOURCE_PATH_MESSAGE + resourceName); } - File canonicalOutputDirectory = outputDirectory.getCanonicalFile(); File outputFile = new File(outputDirectory, resourceName).getCanonicalFile(); if (outputFile.equals(canonicalOutputDirectory) || !outputFile.toPath().startsWith(canonicalOutputDirectory.toPath())) { - throw new MojoExecutionException("Remote resource is outside the output directory: " + resourceName); + throw new MojoExecutionException(INVALID_REMOTE_RESOURCE_PATH_MESSAGE + resourceName); } return outputFile; } diff --git a/src/test/java/org/apache/maven/plugin/resources/remote/RemoteResourcesMojoTest.java b/src/test/java/org/apache/maven/plugin/resources/remote/RemoteResourcesMojoTest.java index 32d2cc1..578bd51 100644 --- a/src/test/java/org/apache/maven/plugin/resources/remote/RemoteResourcesMojoTest.java +++ b/src/test/java/org/apache/maven/plugin/resources/remote/RemoteResourcesMojoTest.java @@ -96,7 +96,7 @@ public class RemoteResourcesMojoTest extends AbstractMojoTestCase { AbstractProcessRemoteResourcesMojo.resolveOutputFile(outputDirectory, "../outside.txt"); fail("expected a resource outside the output directory to be rejected"); } catch (MojoExecutionException e) { - assertTrue(e.getMessage().contains("outside the output directory")); + assertTrue(e.getMessage().contains("must be relative and within the output directory")); } try { @@ -104,7 +104,7 @@ public class RemoteResourcesMojoTest extends AbstractMojoTestCase { outputDirectory, new File(outputDirectory.getParentFile(), "absolute.txt").getAbsolutePath()); fail("expected an absolute resource path outside the output directory to be rejected"); } catch (MojoExecutionException e) { - assertTrue(e.getMessage().contains("outside the output directory")); + assertTrue(e.getMessage().contains("must be relative and within the output directory")); } File outputFile = AbstractProcessRemoteResourcesMojo.resolveOutputFile(outputDirectory, "nested/resource.txt");
