apache / apache/maven-artifact-plugin
AbstractBuildinfoMojo.relative(): naive string prefix-stripping instead of Path.relativize
- Dominant language
- Java
- Stars
- 14
- Forks
- 23
- Avg merge
- 1h 27m
- Merged PRs (30d)
- 8
Description
`AbstractBuildinfoMojo.relative(File)` (lines 452-457) computes a relative path with naive string prefix-stripping instead of `Path.relativize`:
```java
protected String relative(File file) {
File basedir = session.getTopLevelProject().getBasedir();
int length = basedir.getPath().length();
String path = file.getPath();
return path.substring(length + 1);
}
```
Problems:
- It does not verify the file is actually below `basedir`. For `basedir=/a/b` and `file=/a/bc/d` it silently returns `d` instead of `../bc/d`.
- It throws `StringIndexOutOfBoundsException` for paths shorter than `basedir` (e.g. when `basedir` is `/`).
- It ignores path separators/casing on Windows.
This method feeds every "saved to ...", diffoscope, and wget hint in logs, so misleading output is likely.
Related: line 327 (`aggregate.getName().substring(aggregate.getName().lastIndexOf('.'))`) throws the same exception if the filename has no dot.
Suggested fix: use `basedir.toPath().relativize(file.toPath())`.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with AbstractBuildinfoMojo.relative(File) at lines 452-457 and inspect the callers that produce saved-to, diffoscope, and wget log hints. Check the related filename handling at line 327, then run the relevant project tests. Done means relative paths are computed with Path.relativize without misleading prefix matches or the reported path exceptions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100