[I] model validator accepts '.' and '..' as artifactId/version, creating path-traversal segments in local repository paths [maven]

["jmestwa-coder (via GitHub)" <gi...@apache.org>]

jmestwa-coder opened a new issue, #12427:
URL: https://github.com/apache/maven/issues/12427

   ### Affected version
   
   4.1.0-SNAPSHOT (master); the compat maven-model-builder validator has the same gap.
   
   ### Bug description
   
   coordinate ids and versions equal to `.` or `..` pass model validation:
   
   - `isValidCoordinatesId` (maven-impl `DefaultModelValidator`) / `isValidId` (compat) check each character individually and `.` is an allowed character, so the strings `.` and `..` are accepted as groupId/artifactId
   - `validateVersion` only bans the filesystem metacharacters `\/:"<>|?*`, so a version of `..` passes too
   - same gap in the wildcard-id variant
   
   these values are used verbatim as directory segments when an artifact is mapped to its local repository path (`groupId-as-dirs/artifactId/version/artifactId-version.ext` in the default layout, see `DefaultRepositoryLayout.pathOf`), so an artifactId or version of `..` is a literal path-traversal segment.
   
   example: this dependency passes STRICT validation
   
   ```xml
   <dependency>
     <groupId>org.example</groupId>
     <artifactId>..</artifactId>
     <version>1.0</version>
   </dependency>
   ```
   
   and maps to the local-repository path
   
   ```
   org/example/../1.0/..-1.0.jar  ->  org/1.0/..-1.0.jar
   ```
   
   so the `..` segment escapes the coordinate directory. a dependency version of `..` does the same one level down (`org/example/lib/../lib-...jar` -> `org/example/lib-...jar`). any POM in the dependency graph can carry such coordinates.
   
   groupId on its own is not a raw-segment vector since the layout maps its dots to path separators (`org..evil` becomes `org//evil`, an empty segment rather than `..`), but `.`/`..` as a whole groupId is rejected as well for consistency.
   
   fix in #12410: reject `.` and `..` in the id checks, the wildcard variant, and `validateVersion`, in both the maven-impl and compat maven-model-builder validators, with regression tests in each module.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] model validator accepts '.' and '..' as artifactId/version, creating path-traversal segments in local repository paths [maven]

["elharo (via GitHub)" <gi...@apache.org>]

elharo commented on issue #12427:
URL: https://github.com/apache/maven/issues/12427#issuecomment-4903043445

   As best I can tell on a quick search the problem is that "these values are used verbatim as directory segments when an artifact is mapped to its local repository path." I cannot find any reference that states . and .. are illegal group or artifact IDs. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] model validator accepts '.' and '..' as artifactId/version, creating path-traversal segments in local repository paths [maven]

["elharo (via GitHub)" <gi...@apache.org>]

elharo commented on issue #12427:
URL: https://github.com/apache/maven/issues/12427#issuecomment-4903006738

   Anyone remember where the normative rules for maven artifact and group IDs are written down? 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] model validator accepts '.' and '..' as artifactId/version, creating path-traversal segments in local repository paths [maven]

["gnodet (via GitHub)" <gi...@apache.org>]

gnodet closed issue #12427: model validator accepts '.' and '..' as artifactId/version, creating path-traversal segments in local repository paths
URL: https://github.com/apache/maven/issues/12427


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org