You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maven.apache.org by el...@apache.org on 2026/08/02 14:26:59 UTC
(maven-remote-resources-plugin) branch fix/issue-272-consistent-bundle-validation created (now 8ef0878)
This is an automated email from the ASF dual-hosted git repository.
elharo pushed a change to branch fix/issue-272-consistent-bundle-validation
in repository https://gitbox.apache.org/repos/asf/maven-remote-resources-plugin.git
at 8ef0878 Reject malformed resource bundle descriptors consistently in validate() (#272)
This branch includes the following new commits:
new 8ef0878 Reject malformed resource bundle descriptors consistently in validate() (#272)
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(maven-remote-resources-plugin) 01/01: Reject malformed resource bundle descriptors consistently in validate() (#272)
Posted by el...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
elharo pushed a commit to branch fix/issue-272-consistent-bundle-validation
in repository https://gitbox.apache.org/repos/asf/maven-remote-resources-plugin.git
commit 8ef0878f34f3e9c2479afc5ab67143a5407e6e70
Author: Elliotte Rusty Harold <el...@ibiblio.org>
AuthorDate: Sun Aug 2 14:26:51 2026 +0000
Reject malformed resource bundle descriptors consistently in validate() (#272)
---
.../remote/AbstractProcessRemoteResourcesMojo.java | 6 ++++--
.../plugin/resources/remote/RemoteResourcesMojoTest.java | 14 ++++++++++++++
2 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java b/src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java
index 15d3ce3..440deb3 100644
--- a/src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java
+++ b/src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java
@@ -723,9 +723,11 @@ public abstract class AbstractProcessRemoteResourcesMojo extends AbstractMojo {
for (String artifactDescriptor : resourceBundles) {
// groupId:artifactId:version, groupId:artifactId:version:type
// or groupId:artifactId:version:type:classifier
- String[] s = StringUtils.split(artifactDescriptor, ":");
+ // use the same splitting as downloadBundles() so both are consistent;
+ // also reject empty groupId/artifactId/version (e.g. a missing segment)
+ String[] s = artifactDescriptor.split(":");
- if (s.length < 3 || s.length > 5) {
+ if (s.length < 3 || s.length > 5 || s[0].isEmpty() || s[1].isEmpty() || s[2].isEmpty()) {
String position;
if (bundleCount == 1) {
diff --git a/src/test/java/org/apache/maven/plugin/resources/remote/RemoteResourcesMojoTest.java b/src/test/java/org/apache/maven/plugin/resources/remote/RemoteResourcesMojoTest.java
index 583732b..e21120f 100644
--- a/src/test/java/org/apache/maven/plugin/resources/remote/RemoteResourcesMojoTest.java
+++ b/src/test/java/org/apache/maven/plugin/resources/remote/RemoteResourcesMojoTest.java
@@ -41,6 +41,7 @@ import org.apache.maven.artifact.versioning.VersionRange;
import org.apache.maven.execution.DefaultMavenExecutionRequest;
import org.apache.maven.execution.DefaultMavenExecutionResult;
import org.apache.maven.execution.MavenSession;
+import org.apache.maven.plugin.MojoExecutionException;
import org.apache.maven.plugin.resources.remote.stub.MavenProjectBuildStub;
import org.apache.maven.plugin.resources.remote.stub.MavenProjectResourcesStub;
import org.apache.maven.plugin.testing.AbstractMojoTestCase;
@@ -279,6 +280,19 @@ public class RemoteResourcesMojoTest extends AbstractMojoTestCase {
assertTrue(data.contains("rules"));
}
+ public void testValidateRejectsDescriptorWithEmptySegment() throws Exception {
+ final MavenProjectResourcesStub project = createTestProject("default-validate");
+ final ProcessRemoteResourcesMojo mojo =
+ lookupProcessMojoWithSettings(project, new String[] {"org.example:dep::jar"});
+
+ try {
+ mojo.validate();
+ fail("Expected validate() to reject a resource bundle descriptor with a missing version");
+ } catch (MojoExecutionException e) {
+ assertTrue(e.getMessage().contains("resource bundle"));
+ }
+ }
+
protected void buildResourceBundle(String id, String sourceEncoding, String[] resourceNames, File jarName)
throws Exception {
final MavenProjectResourcesStub project = createTestProject(id);