apache / apache/maven-script-interpreter

Script decoding falls back to platform default charset, breaking reproducibility

Open
#206 1 comment 0 reactions 1 assignee Claimed by @elharo View on GitHub
bug
Dominant language
Java
Stars
14
Forks
9
Avg merge
5d 15h
Merged PRs (30d)
2

Description

**Describe the bug**

Script file reading falls back to the platform default charset when no script encoding is configured, which makes build results dependent on the host encoding.

`ScriptRunner.executeRun` decodes the script with `new String(bytes)` when `encoding` is `null` (ScriptRunner.java:202-206), i.e. the platform default charset. The `ScriptRunner` javadoc for `setScriptEncoding` (ScriptRunner.java:119-127) documents this default, but on JDK versions before 18 the platform default is locale/OS-dependent, so:

- the same project can build successfully on one machine and fail (or behave differently) on another when the script contains non-ASCII characters; and
- on JDK 18+ the default silently changes to UTF-8, so behavior differs across JDK versions.

Additionally, `MirrorStreamWrapper.write(byte[], int, int)` decodes mirrored output with `new String(b, off, len)` (FileLogger.java:155), always the platform default charset, which can disagree with the charset used to read the script.

**To Reproduce**

Run a hook script containing a non-ASCII literal (e.g. `println "café"`) with `setScriptEncoding` never called, on two machines with different default charsets (or on JDK 11 vs JDK 17+).

**Expected behavior**

A stable, predictable default (e.g. UTF-8) regardless of platform, with an option to override.

**Actual behavior**

The decoded script content (and mirrored output) depends on the host's platform default charset.

**Suggested fix**

- Default `encoding` to `StandardCharsets.UTF_8` when not explicitly set instead of using the platform default.
- Decode mirrored bytes in `MirrorStreamWrapper` with the same explicit charset.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.