gnodet opened a new pull request, #12977: URL: https://github.com/apache/maven/pull/12977
## Summary Forward-port of #12954 from `maven-3.10.x` to `maven-4.0.x`, adapting all three fixes for the 4.0.x module structure and API differences: - **`OriginBoundAuthenticationSelector`** (new file in `impl/maven-core`): scopes server credentials to the declared origins (protocol, host, port) of repositories and mirrors configured in settings, preventing credential leakage to unrelated repositories. Supports three modes via `maven.repository.credentialScope`: `origin` (default), `strict`, and `id` (legacy). - **Relocation coordinate validation** (`compat/maven-compat` `MavenMetadataSource`): validates relocation `groupId`, `artifactId`, and `version` components before applying them, rejecting path traversal characters (`/`, `\`, `..`) and control characters. - **Exact server ID matching** (`compat/maven-compat` `DefaultWagonManager`): uses `equals` instead of `equalsIgnoreCase` for server ID matching, consistent with `LegacyRepositorySystem.injectAuthentication` and the resolver's authentication selector. ### Adaptations for 4.0.x - Module paths: `maven-compat/` -> `compat/maven-compat/`, `maven-core/` -> `impl/maven-core/` - `OriginBoundAuthenticationSelector` uses `org.slf4j.Logger` (4.0.x) instead of `org.codehaus.plexus.logging.Logger` (3.10.x) - Credential scope property read from `mergedProps` (4.0.x property flow) instead of `ConfigUtils.getString(configProps, ...)` (3.10.x) - `MavenMetadataSourceRelocationTest` uses constructor injection (4.0.x) instead of reflection-based field injection (3.10.x) ## Test plan - [x] `mvn verify -pl impl/maven-core` -- 602 tests pass, 0 failures - [x] `mvn verify -pl compat/maven-compat` -- 156 tests pass, 0 failures - [x] New `OriginBoundAuthenticationSelectorTest` covers: declared origin matching, origin scoping, undeclared ID legacy behavior, strict mode refusal, ID scope passthrough, unknown scope rejection, origin normalization - [x] New `MavenMetadataSourceRelocationTest` covers: invalid artifactId rejection, well-formed relocation application 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
