apache / apache/maven-remote-resources-plugin

appendPath/resolvePath drop trailing slashes and swallow excess '..' segments

Open
#274 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
17
Forks
18
Avg merge
6h 5m
Merged PRs (30d)
5

Description

## Summary
The SCM-path normalization in `ModelInheritanceAssembler` has edge-case inaccuracies.

`src/main/java/org/apache/maven/plugin/resources/remote/ModelInheritanceAssembler.java:548-616`

```java
protected String appendPath(String parentPath, String childPath, String pathAdjustment, boolean appendPaths) {
...
return cleanedPath + resolvePath(uncleanPath);
}

private static String resolvePath(String uncleanPath) {
LinkedList pathElements = new LinkedList<>();
StringTokenizer tokenizer = new StringTokenizer(uncleanPath, "/");
while (tokenizer.hasMoreTokens()) {
String token = tokenizer.nextToken();
switch (token) {
case "": break;
case "..":
if (pathElements.isEmpty()) {
// FIXME: somehow report to the user that there are too many '..' elements.
// For now, ignore the extra '..'.
} else {
pathElements.removeLast();
}
break;
default:
pathElements.addLast(token);
break;
}
}
...
}
```

## Problems
1. Excess `..` segments are silently ignored (there is a `// FIXME` acknowledging this) — a parent SCM URL with too many `..` yields a path that does not match what the user wrote, with no warning.
2. Trailing slashes are dropped: `http://x/repo/` + child becomes `http://x/repo/child` (arguably fine), but a bare `http://x/repo/` (no child) normalizes to `http://x/repo`, changing the URL.
3. `""` tokens (double slashes `//`) are silently removed, which can collapse URLs that legitimately contain them.

## Impact
Inherited `scm` connection/url values in supplemental models can be subtly wrong for unusual parent URLs, producing checkout paths that differ from the source repository layout.

## Suggested fix
Move to a well-tested path normalizer (e.g. `java.nio.file.Paths`/URI handling, or `plexus-utils` `PathTool`) and decide explicitly how to handle excess `..`, trailing slashes, and empty segments; emit a warning instead of silently dropping path elements.

Contributor guide

No contributing guide indexed for this repository

Research direction

Read src/main/java/org/apache/maven/plugin/resources/remote/ModelInheritanceAssembler.java:548-616, starting with appendPath and resolvePath, and trace how parent and child SCM paths are combined. Define and cover expected behavior for excess '..' segments, trailing slashes, and empty segments; done means these cases are handled explicitly without silently changing the intended SCM path.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.