gnodet opened a new pull request, #446: URL: https://github.com/apache/maven-install-plugin/pull/446
## Summary Hardens the embedded-POM trust boundary in `install:install-file`, addressing four findings from a static security audit of the Maven 4 line (commit `0bfcb64`). ### Findings addressed | ID | Severity | Title | |---|---|---| | f001 | MEDIUM | Embedded JAR POM silently chooses install coordinates, poisoning shared local repo | | f002 | MEDIUM | Foreign embedded POM installed verbatim even with explicit CLI coordinates | | f003 | LOW | Defense-in-depth DOCTYPE rejection for attacker-authored embedded POM | | f004 | LOW | Coordinate validators accept dot-only and empty segments, escaping coordinate directory | ### Changes - **Coordinate adoption visibility (f001):** Fail when multiple `META-INF/maven/*/pom.xml` entries match; validate entry-path `<g>/<a>` against the embedded POM's effective GAV; log adopted coordinates at INFO (was DEBUG); WARN before overwriting an existing local-repo artifact with different content; validate `packaging` with the same rules as other coordinates. - **CLI-coordinate priority (f002):** When the operator supplies complete g/a/v/packaging, skip `readingPomFromJarFile()` entirely and generate a minimal POM. When partial coordinates are supplied, cross-check each against the embedded POM and fail on mismatch. - **DOCTYPE screening (f003):** Pre-scan embedded POM bytes for `<!DOCTYPE` before handing them to `ModelXmlFactory.read()`. Encoding-aware: BOM/first-bytes/XML-declaration sniffer covering UTF-8/16/32 and EBCDIC, with fail-closed handling for unsupported encodings and unterminated declarations. - **Coordinate validation (f004):** `isValidId()` rejects empty and dot-only values; new `isValidGroupId()` rejects leading/trailing/consecutive dots; `isValidVersion()` rejects empty and dot-only values. Defense in depth: composed layout path must reside under the local repository root. ### Category **Security hardening** — no live exploit demonstrated; static-analysis findings from a 5-lane audit with blind triage panel. ## Test plan - [ ] All new unit tests pass (coordinate adoption, entry-path mismatch, multiple POM entries, invalid packaging, DOCTYPE rejection in UTF-8/UTF-16LE/UTF-16BE/EBCDIC/padded-declaration, leading-dot groupId, consecutive-dot groupId, dot-dot artifactId, dot-dot version, full-coordinates hostile POM ignored, partial-coordinates mismatch rejected, partial-coordinates match accepted) - [ ] Existing tests pass unchanged - [ ] `mvn clean install -B` succeeds 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
