(groovy) 01/07: GROOVY-12073: groovy-grape: reject dot-dot segments in coordinate validation (port for 5_1_X)

[pa...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

paulk-asert pushed a commit to branch GROOVY_5_1_X
in repository https://gitbox.apache.org/repos/asf/groovy.git

commit a54a716885b20650fed2b4e7a9ab1ff568c9e5bb
Author: netliomax25-code <ne...@gmail.com>
AuthorDate: Tue Aug 11 13:51:44 2026 +1000

    GROOVY-12073: groovy-grape: reject dot-dot segments in coordinate validation (port for 5_1_X)
---
 src/main/groovy/groovy/grape/GrapeIvy.groovy     |  3 +++
 src/test/groovy/groovy/grape/GrapeIvyTest.groovy | 27 ++++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/src/main/groovy/groovy/grape/GrapeIvy.groovy b/src/main/groovy/groovy/grape/GrapeIvy.groovy
index 6fb9279a5b..f8f8dc6ca7 100644
--- a/src/main/groovy/groovy/grape/GrapeIvy.groovy
+++ b/src/main/groovy/groovy/grape/GrapeIvy.groovy
@@ -218,6 +218,9 @@ class GrapeIvy implements GrapeEngine {
                         throw new RuntimeException("Grab: invalid value of '$v' for $k: should only contain - . _ a-z A-Z 0-9")
                     }
                 }
+                if (v.toString().contains('..')) {
+                    throw new RuntimeException("Grab: invalid value of '$v' for $k: should not contain '..'")
+                }
             }
         }
 
diff --git a/src/test/groovy/groovy/grape/GrapeIvyTest.groovy b/src/test/groovy/groovy/grape/GrapeIvyTest.groovy
index 6fb41ad73d..23829b6129 100644
--- a/src/test/groovy/groovy/grape/GrapeIvyTest.groovy
+++ b/src/test/groovy/groovy/grape/GrapeIvyTest.groovy
@@ -392,6 +392,33 @@ final class GrapeIvyTest {
         assert ex.message.contains("Grab: invalid value of '0.41|' for version")
     }
 
+    @Test
+    void testInvalidVersionDotDot() {
+        def ex = shouldFail '''
+            groovy.grape.Grape.grab(group: 'org.ejml', module: 'ejml-simple', version: '..')
+        '''
+        assert ex.message.contains('for version')
+        assert ex.message.contains("should not contain '..'")
+    }
+
+    @Test
+    void testInvalidGroupDotDot() {
+        def ex = shouldFail '''
+            groovy.grape.Grape.grab(group: '..', module: 'ejml-simple', version: '0.41')
+        '''
+        assert ex.message.contains('for group')
+        assert ex.message.contains("should not contain '..'")
+    }
+
+    @Test
+    void testInvalidModuleDotDot() {
+        def ex = shouldFail '''
+            groovy.grape.Grape.grab(group: 'org.ejml', module: '..', version: '0.41')
+        '''
+        assert ex.message.contains('for module')
+        assert ex.message.contains("should not contain '..'")
+    }
+
     @Test
     void testInvalidMutuallyExclusiveArgs() {
         def ex = shouldFail '''