gnodet opened a new pull request, #12976: URL: https://github.com/apache/maven/pull/12976
## Summary Forward-port of #12954 (`maven-3.10.x`) to `master`, adapted for the 4.x module layout (`compat/` and `impl/` prefixes) and API changes (SLF4J logging, constructor injection). Three fixes: 1. **`OriginBoundAuthenticationSelector`** — scopes server credentials to the origins (protocol+host+port) declared for the same server id in settings mirrors/repositories, preventing credential leakage to repositories that merely share a server id. Controlled by the new `maven.repository.credentialScope` user property (`origin` | `strict` | `id`). 2. **Relocation coordinate validation in `MavenMetadataSource`** — rejects relocation `groupId` / `artifactId` / `version` values that contain path-traversal characters (`/`, `\`, `..`) or control characters before they are applied to the artifact being resolved. 3. **Exact server ID matching in `DefaultWagonManager`** — replaces `equalsIgnoreCase` with `equals` for consistency with `LegacyRepositorySystem.injectAuthentication` and the resolver's authentication selector. ## Adapted paths | 3.10.x path | master path | |---|---| | `maven-compat/src/…/DefaultWagonManager.java` | `compat/maven-compat/src/…/DefaultWagonManager.java` | | `maven-core/src/…/DefaultRepositorySystemSessionFactory.java` | `impl/maven-core/src/…/DefaultRepositorySystemSessionFactory.java` | | `maven-core/src/…/OriginBoundAuthenticationSelector.java` | `impl/maven-core/src/…/OriginBoundAuthenticationSelector.java` | | `maven-core/src/…/MavenMetadataSource.java` | `compat/maven-compat/src/…/MavenMetadataSource.java` | ## API adaptations for master - Uses `org.slf4j.Logger` instead of `org.codehaus.plexus.logging.Logger` - Uses `mergedProps.getOrDefault()` instead of `ConfigUtils.getString()` (not available on master) - Test uses constructor injection instead of reflection-based field injection (matching master's `MavenMetadataSource` constructor) - `@since 4.0.0` on the new constant (instead of `3.10.0`) ## Test plan - [x] `OriginBoundAuthenticationSelectorTest` — 7 tests covering origin/strict/id scopes, origin normalization, and unknown scope rejection - [x] `MavenMetadataSourceRelocationTest` — 2 tests verifying invalid relocations are rejected and well-formed relocations are applied - [x] `mvn verify -pl impl/maven-core` — 642 tests pass - [x] `mvn verify -pl compat/maven-compat` — 162 tests pass 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
