gnodet commented on code in PR #13401:
URL: https://github.com/apache/maven/pull/13401#discussion_r4240601993
##########
impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultProfileActivationContext.java:
##########
@@ -389,18 +387,9 @@ public boolean isProfileInactive(String profileId) {
return
DefaultProfileActivationContext.this.isProfileInactive(profileId);
}
- /**
- * System property lookup with model property fallback.
- * System properties take precedence; model properties fill in as
a fallback
- * so POM-declared values drive property-activated profiles in
external models.
- */
@Override
public String getSystemProperty(String key) {
- String value =
DefaultProfileActivationContext.this.getSystemProperty(key);
- if (value == null) {
- value =
DefaultProfileActivationContext.this.getModelProperty(key);
- }
- return value;
+ return
DefaultProfileActivationContext.this.getSystemProperty(key);
}
Review Comment:
⚠️ **Incomplete sandbox — `ConditionProfileActivator` still sees
POM-declared properties**
`getSystemProperty()` is now correctly sandboxed (line 392), but the
adjacent `getModelProperty()` override (line 402–403) still delegates to the
parent context without restriction:
```java
@Override
public String getModelProperty(String key) {
return DefaultProfileActivationContext.this.getModelProperty(key);
}
```
`ConditionProfileActivator.doGetProperty()` queries
`context.getModelProperty(name)` first (line 189), before falling back to
`getSystemProperty`. In the external-model sandbox this means `<condition>`
expressions in dependency POMs can still see POM-declared `<properties>`,
making `<condition>`-based profile activation in external builds **not**
symmetric with `<properties>`-based activation.
If the intent is that no POM-declared property should influence
external-model profile activation, `getModelProperty()` should either return
`null` or be blocked here too. If the asymmetry is intentional, it should be
documented.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
