elharo opened a new issue, #249: URL: https://github.com/apache/maven-artifact-plugin/issues/249
`ReproducibleCentralReport.renderReproducibleCentralArtifact()` (lines 175-178) interpolates POM coordinates directly into URLs without encoding: ```java String badge = "https://img.shields.io/reproducible-central/artifact/"; + groupId + '/' + artifactId + '/' + version + "?labelColor=1e5b96"; ``` The report is generated for the project being sited, but `group-id`/`artifactId`/`version` come from the POM (arbitrary user input for third-party projects) and are passed straight into `sink.figureGraphics(...)`. A version containing characters such as `&`, `?`, `#`, `"`, or `/` produces: - a broken/misleading badge image (wrong query string), and - potentially malformed/foreign HTML in the generated site report (stored-HTML injection in published project sites). Suggested fix: URL-encode each coordinate segment (e.g. `URLEncoder.encode(..., StandardCharsets.UTF_8)`) before building the URL. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
