gnodet opened a new pull request, #447: URL: https://github.com/apache/maven-install-plugin/pull/447
## Summary Backport of the embedded-POM trust boundary hardening from master to the 3.x maintenance line. Addresses four findings from a static security audit. ### Findings addressed | ID | Severity | Title | |---|---|---| | f001 | MEDIUM | Embedded JAR POM silently chooses install coordinates, poisoning shared local repo | | f002 | MEDIUM | Foreign embedded POM installed verbatim even with explicit CLI coordinates | | f003 | LOW | Defense-in-depth DOCTYPE rejection for attacker-authored embedded POM | | f004 | LOW | Coordinate validators accept dot-only and empty segments, escaping coordinate directory | ### Changes Same logical fixes as the master PR, adapted to Maven 3 APIs (MavenXpp3Reader, MojoExecutionException, Aether, etc.): - **Coordinate adoption visibility (f001):** Fail when multiple `META-INF/maven/*/pom.xml` entries match; validate entry-path vs model GAV; log at INFO; warn before overwriting; validate packaging. - **CLI-coordinate priority (f002):** When full g/a/v/packaging supplied, skip embedded POM and generate minimal POM. When partial coordinates supplied, cross-check against embedded POM. - **DOCTYPE screening (f003):** Encoding-aware pre-scan for `<!DOCTYPE` before parsing embedded POM XML. - **Coordinate validation (f004):** Reject empty/dot-only IDs, leading-dot groupIds. Containment-check install path against local repository root. ### Note on InstallMojo The 3.x `InstallMojo` does NOT need these changes — its architecture uses a single atomic `InstallRequest` (no per-project loop), and it already matches by plugin presence, not execution-id. ### Category **Security hardening** — backport from master. ## Test plan - [ ] New unit tests for all 4 findings pass - [ ] Existing tests pass unchanged - [ ] `mvn clean install -B` succeeds 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
