jmestwa-coder opened a new issue, #12427:
URL: https://github.com/apache/maven/issues/12427
### Affected version
4.1.0-SNAPSHOT (master); the compat maven-model-builder validator has the
same gap.
### Bug description
coordinate ids and versions equal to `.` or `..` pass model validation:
- `isValidCoordinatesId` (maven-impl `DefaultModelValidator`) / `isValidId`
(compat) check each character individually and `.` is an allowed character, so
the strings `.` and `..` are accepted as groupId/artifactId
- `validateVersion` only bans the filesystem metacharacters `\/:"<>|?*`, so
a version of `..` passes too
- same gap in the wildcard-id variant
these values are used verbatim as directory segments when an artifact is
mapped to its local repository path
(`groupId-as-dirs/artifactId/version/artifactId-version.ext` in the default
layout, see `DefaultRepositoryLayout.pathOf`), so an artifactId or version of
`..` is a literal path-traversal segment.
example: this dependency passes STRICT validation
```xml
<dependency>
<groupId>org.example</groupId>
<artifactId>..</artifactId>
<version>1.0</version>
</dependency>
```
and maps to the local-repository path
```
org/example/../1.0/..-1.0.jar -> org/1.0/..-1.0.jar
```
so the `..` segment escapes the coordinate directory. a dependency version
of `..` does the same one level down (`org/example/lib/../lib-...jar` ->
`org/example/lib-...jar`). any POM in the dependency graph can carry such
coordinates.
groupId on its own is not a raw-segment vector since the layout maps its
dots to path separators (`org..evil` becomes `org//evil`, an empty segment
rather than `..`), but `.`/`..` as a whole groupId is rejected as well for
consistency.
fix in #12410: reject `.` and `..` in the id checks, the wildcard variant,
and `validateVersion`, in both the maven-impl and compat maven-model-builder
validators, with regression tests in each module.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
