gnodet opened a new pull request, #12978: URL: https://github.com/apache/maven/pull/12978
## Summary Backport of the path traversal and checksum policy fixes from #12945 (maven-4.0.x) to maven-3.10.x. - **Path traversal validation on repository keys**: `AbstractRepositoryMetadata.getLocalFilename` and `LegacyLocalRepositoryManager.ArtifactMetadataAdapter.getLocalFilename` now reject a repository key that is `..`, contains `/`, `\`, `:`, or an ISO control character before using it in a local file name. - **Version token validation in metadata**: `DefaultRepositoryMetadataManager.readMetadata` validates every version token carried by parsed repository metadata (latest, release, versions, snapshot versions, snapshot timestamp) for the same path traversal characters. - **Checksum policy enforcement**: `DefaultRepositoryMetadataManager.resolve` now catches `ChecksumFailedException` separately and fails metadata resolution under `checksumPolicy=fail` instead of downgrading to a warning. The update-check file is only touched on success, not-found, or generic transfer failure, so checksum failures are retried on the next build. `getArtifactMetadataFromDeploymentRepository` and `LegacyRepositorySystem.retrieve` resolve the effective policy from the repository configuration instead of hardcoding `warn`. The proxy clone fix (`DefaultSettingsDecrypter`) is already present on maven-3.10.x and is therefore not included here. Adapted for the 3.10.x module structure (no `compat/` prefix) and API differences (`MetadataXpp3Reader` instead of `MetadataStaxReader`, no pattern matching `instanceof`). ## Test plan - [x] `AbstractRepositoryMetadataTest` (4 tests): repo keys with `/`, `\`, `..`, `:` are rejected; well-formed key produces correct filename - [x] `LegacyLocalRepositoryManagerTest` (3 tests): repo keys with path separators and `..` are rejected in the inner adapter - [x] `DefaultRepositoryMetadataManagerValidationTest` (2 tests): metadata with invalid version token (colon) and invalid snapshot timestamp (colon) are rejected - [x] `DefaultRepositoryMetadataManagerTest` (1 test): `resolve()` throws `RepositoryMetadataResolutionException` when checksum policy is `fail` and checksums do not match - [x] `LegacyRepositorySystemTest.testRetrieveHonorsConfiguredFailChecksumPolicy`: `retrieve()` throws `ArtifactTransferFailedException` when checksum policy is `fail` - [x] `mvn verify -pl maven-core -B` passes - [x] `mvn verify -pl maven-compat -B` passes 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
