Update to Resolver 2.0.21

maven-compat/src/main/java/org/apache/maven/artifact/repository/metadata/DefaultRepositoryMetadataManager.java

@@ -33,8 +33,8 @@
 import org.apache.maven.artifact.repository.ArtifactRepositoryPolicy;
 import org.apache.maven.artifact.repository.DefaultRepositoryRequest;
 import org.apache.maven.artifact.repository.RepositoryRequest;
-import org.apache.maven.artifact.repository.metadata.io.xpp3.MetadataXpp3Reader;
 import org.apache.maven.artifact.repository.metadata.io.xpp3.MetadataXpp3Writer;
+import org.apache.maven.repository.internal.metadata.ValidatingMetadataXpp3Reader;
 import org.apache.maven.repository.legacy.UpdateCheckManager;
 import org.apache.maven.repository.legacy.WagonManager;
 import org.apache.maven.wagon.ResourceDoesNotExistException;
@@ -270,7 +270,7 @@ protected Metadata readMetadata(File mappingFile) throws RepositoryMetadataReadE
         Metadata result;
 
         try (Reader reader = ReaderFactory.newXmlReader(mappingFile)) {
-            MetadataXpp3Reader mappingReader = new MetadataXpp3Reader();
+            ValidatingMetadataXpp3Reader mappingReader = new ValidatingMetadataXpp3Reader();
 
             result = mappingReader.read(reader, false);
         } catch (FileNotFoundException e) {

maven-core/src/main/java/org/apache/maven/artifact/repository/metadata/AbstractRepositoryMetadata.java

@@ -27,8 +27,8 @@
 import org.apache.maven.artifact.metadata.ArtifactMetadata;
 import org.apache.maven.artifact.repository.ArtifactRepository;
 import org.apache.maven.artifact.repository.ArtifactRepositoryPolicy;
-import org.apache.maven.artifact.repository.metadata.io.xpp3.MetadataXpp3Reader;
 import org.apache.maven.artifact.repository.metadata.io.xpp3.MetadataXpp3Writer;
+import org.apache.maven.repository.internal.metadata.ValidatingMetadataXpp3Reader;
 import org.codehaus.plexus.util.ReaderFactory;
 import org.codehaus.plexus.util.WriterFactory;
 import org.codehaus.plexus.util.xml.pull.XmlPullParserException;
@@ -64,7 +64,7 @@ public void storeInLocalRepository(ArtifactRepository localRepository, ArtifactR
 
     protected void updateRepositoryMetadata(ArtifactRepository localRepository, ArtifactRepository remoteRepository)
             throws IOException, XmlPullParserException {
-        MetadataXpp3Reader mappingReader = new MetadataXpp3Reader();
+        ValidatingMetadataXpp3Reader mappingReader = new ValidatingMetadataXpp3Reader();
 
         Metadata metadata = null;
 

maven-core/src/main/java/org/apache/maven/artifact/repository/metadata/io/DefaultMetadataReader.java

@@ -29,7 +29,7 @@
 import java.util.Objects;
 
 import org.apache.maven.artifact.repository.metadata.Metadata;
-import org.apache.maven.artifact.repository.metadata.io.xpp3.MetadataXpp3Reader;
+import org.apache.maven.repository.internal.metadata.ValidatingMetadataXpp3Reader;
 import org.codehaus.plexus.util.ReaderFactory;
 import org.codehaus.plexus.util.xml.pull.XmlPullParserException;
 
@@ -54,7 +54,7 @@ public Metadata read(Reader input, Map<String, ?> options) throws IOException {
         Objects.requireNonNull(input, "input cannot be null");
 
         try (Reader in = input) {
-            return new MetadataXpp3Reader().read(in, isStrict(options));
+            return new ValidatingMetadataXpp3Reader().read(in, isStrict(options));
         } catch (XmlPullParserException e) {
             throw new MetadataParseException(e.getMessage(), e.getLineNumber(), e.getColumnNumber(), e);
         }
@@ -64,7 +64,7 @@ public Metadata read(InputStream input, Map<String, ?> options) throws IOExcepti
         Objects.requireNonNull(input, "input cannot be null");
 
         try (InputStream in = input) {
-            return new MetadataXpp3Reader().read(in, isStrict(options));
+            return new ValidatingMetadataXpp3Reader().read(in, isStrict(options));
         } catch (XmlPullParserException e) {
             throw new MetadataParseException(e.getMessage(), e.getLineNumber(), e.getColumnNumber(), e);
         }

maven-core/src/main/java/org/apache/maven/internal/aether/MavenValidator.java

@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.internal.aether;
+
+import org.eclipse.aether.artifact.Artifact;
+import org.eclipse.aether.graph.Dependency;
+import org.eclipse.aether.metadata.Metadata;
+import org.eclipse.aether.repository.LocalRepository;
+import org.eclipse.aether.spi.validator.Validator;
+import org.eclipse.aether.util.PathUtils;
+
+/**
+ * Simplest Maven specific validator that is meant to prevent un-interpolated
+ * elements enter resolver; if it does, is most likely some bug.
+ * <p>
+ * Note: {@link org.eclipse.aether.repository.RemoteRepository} is not validated here,
+ * see <a href="https://github.com/apache/maven/issues/7398">GH-7398</a> for details,
+ * and to keep very same behavior as Maven 3 did so far. If you want more, upgrade to Maven 4 ;)
+ */
+public class MavenValidator implements Validator {
+    protected boolean containsPlaceholder(String value) {
+        return value != null && value.contains("${");
+    }
+
+    @Override
+    public void validateArtifact(Artifact artifact) throws IllegalArgumentException {
+        if (containsPlaceholder(artifact.getGroupId())
+                || containsPlaceholder(artifact.getArtifactId())
+                || containsPlaceholder(artifact.getVersion())
+                || containsPlaceholder(artifact.getClassifier())
+                || containsPlaceholder(artifact.getExtension())) {
+            throw new IllegalArgumentException("Not fully interpolated artifact " + artifact);
+        }
+        PathUtils.validateArtifactComponents(artifact);
+    }
+
+    @Override
+    public void validateMetadata(Metadata metadata) throws IllegalArgumentException {
+        if (containsPlaceholder(metadata.getGroupId())
+                || containsPlaceholder(metadata.getArtifactId())
+                || containsPlaceholder(metadata.getVersion())
+                || containsPlaceholder(metadata.getType())) {
+            throw new IllegalArgumentException("Not fully interpolated metadata " + metadata);
+        }
+        PathUtils.validateMetadataComponents(metadata);
+    }
+
+    @Override
+    public void validateDependency(Dependency dependency) throws IllegalArgumentException {
+        Artifact artifact = dependency.getArtifact();
+        if (containsPlaceholder(artifact.getGroupId())
+                || containsPlaceholder(artifact.getArtifactId())
+                || containsPlaceholder(artifact.getVersion())
+                || containsPlaceholder(artifact.getClassifier())
+                || containsPlaceholder(artifact.getExtension())
+                || containsPlaceholder(dependency.getScope())
+                || dependency.getExclusions().stream()
+                        .anyMatch(e -> containsPlaceholder(e.getGroupId())
+                                || containsPlaceholder(e.getArtifactId())
+                                || containsPlaceholder(e.getClassifier())
+                                || containsPlaceholder(e.getExtension()))) {
+            throw new IllegalArgumentException("Not fully interpolated dependency " + dependency);
+        }
+        PathUtils.validateArtifactComponents(artifact);
+    }
+
+    @Override
+    public void validateLocalRepository(LocalRepository localRepository) throws IllegalArgumentException {
+        if (containsPlaceholder(localRepository.getBasePath().toString())
+                || containsPlaceholder(localRepository.getContentType())
+                || containsPlaceholder(localRepository.getId())) {
+            throw new IllegalArgumentException("Not fully interpolated local repository " + localRepository);
+        }
+    }
+}

maven-core/src/main/java/org/apache/maven/internal/aether/MavenValidatorFactory.java

@@ -0,0 +1,37 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.internal.aether;
+
+import javax.inject.Named;
+import javax.inject.Singleton;
+
+import org.eclipse.aether.RepositorySystemSession;
+import org.eclipse.aether.spi.validator.Validator;
+import org.eclipse.aether.spi.validator.ValidatorFactory;
+
+@Named
+@Singleton
+public class MavenValidatorFactory implements ValidatorFactory {
+    private final MavenValidator instance = new MavenValidator();
+
+    @Override
+    public Validator newInstance(RepositorySystemSession repositorySystemSession) {
+        return instance;
+    }
+}

maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/DefaultVersionRangeResolver.java

@@ -34,7 +34,7 @@
 
 import org.apache.maven.artifact.ArtifactUtils;
 import org.apache.maven.artifact.repository.metadata.Versioning;
-import org.apache.maven.artifact.repository.metadata.io.xpp3.MetadataXpp3Reader;
+import org.apache.maven.repository.internal.metadata.ValidatingMetadataXpp3Reader;
 import org.eclipse.aether.RepositoryEvent;
 import org.eclipse.aether.RepositoryEvent.EventType;
 import org.eclipse.aether.RepositorySystemSession;
@@ -274,8 +274,9 @@ private Versioning readVersions(
 
                     if (metadata.getFile() != null && metadata.getFile().exists()) {
                         try (InputStream in = new FileInputStream(metadata.getFile())) {
-                            versioning =
-                                    new MetadataXpp3Reader().read(in, false).getVersioning();
+                            versioning = new ValidatingMetadataXpp3Reader()
+                                    .read(in, false)
+                                    .getVersioning();
                         }
                     }
                 }

maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/DefaultVersionResolver.java

@@ -36,7 +36,7 @@
 import org.apache.maven.artifact.repository.metadata.Snapshot;
 import org.apache.maven.artifact.repository.metadata.SnapshotVersion;
 import org.apache.maven.artifact.repository.metadata.Versioning;
-import org.apache.maven.artifact.repository.metadata.io.xpp3.MetadataXpp3Reader;
+import org.apache.maven.repository.internal.metadata.ValidatingMetadataXpp3Reader;
 import org.codehaus.plexus.util.StringUtils;
 import org.eclipse.aether.RepositoryCache;
 import org.eclipse.aether.RepositoryEvent;
@@ -278,8 +278,9 @@ private Versioning readVersions(
 
                     if (metadata.getFile() != null && metadata.getFile().exists()) {
                         try (InputStream in = new FileInputStream(metadata.getFile())) {
-                            versioning =
-                                    new MetadataXpp3Reader().read(in, false).getVersioning();
+                            versioning = new ValidatingMetadataXpp3Reader()
+                                    .read(in, false)
+                                    .getVersioning();
 
                             /*
                             NOTE: Users occasionally misuse the id "local" for remote repos which screws up the metadata

maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/MavenMetadata.java

@@ -28,8 +28,8 @@
 import java.util.Map;
 
 import org.apache.maven.artifact.repository.metadata.Metadata;
-import org.apache.maven.artifact.repository.metadata.io.xpp3.MetadataXpp3Reader;
 import org.apache.maven.artifact.repository.metadata.io.xpp3.MetadataXpp3Writer;
+import org.apache.maven.repository.internal.metadata.ValidatingMetadataXpp3Reader;
 import org.codehaus.plexus.util.ReaderFactory;
 import org.codehaus.plexus.util.WriterFactory;
 import org.codehaus.plexus.util.xml.pull.XmlPullParserException;
@@ -99,7 +99,7 @@ static Metadata read(File metadataFile) throws RepositoryException {
         }
 
         try (Reader reader = ReaderFactory.newXmlReader(metadataFile)) {
-            return new MetadataXpp3Reader().read(reader, false);
+            return new ValidatingMetadataXpp3Reader().read(reader, false);
         } catch (IOException e) {
             throw new RepositoryException("Could not read metadata " + metadataFile + ": " + e.getMessage(), e);
         } catch (XmlPullParserException e) {

maven-resolver-provider/src/main/java/org/apache/maven/repository/internal/metadata/ValidatingMetadataXpp3Reader.java

@@ -0,0 +1,75 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.repository.internal.metadata;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.Reader;
+
+import org.apache.maven.artifact.repository.metadata.Metadata;
+import org.apache.maven.artifact.repository.metadata.Versioning;
+import org.apache.maven.artifact.repository.metadata.io.xpp3.MetadataXpp3Reader;
+import org.codehaus.plexus.util.xml.pull.XmlPullParserException;
+import org.eclipse.aether.util.PathUtils;
+
+/**
+ * Validating metadata reader.
+ *
+ * @since 3.10.0
+ */
+public final class ValidatingMetadataXpp3Reader {
+    private final MetadataXpp3Reader mr = new MetadataXpp3Reader();
+
+    /**
+     * Delegates to {@link MetadataXpp3Reader#read(Reader, boolean)}
+     */
+    public Metadata read(Reader reader, boolean strict) throws IOException, XmlPullParserException {
+        return validate(mr.read(reader, strict));
+    }
+
+    /**
+     * Delegates to {@link MetadataXpp3Reader#read(InputStream, boolean)}
+     */
+    public Metadata read(InputStream in, boolean strict) throws IOException, XmlPullParserException {
+        return validate(mr.read(in, strict));
+    }
+
+    /**
+     * Validates {@link Metadata}.
+     */
+    public static Metadata validate(Metadata metadata) {
+        if (metadata != null) {
+            PathUtils.validatePathComponent(metadata.getVersion(), "version");
+            Versioning versioning = metadata.getVersioning();
+            if (versioning != null) {
+                PathUtils.validatePathComponent(versioning.getLatest(), "versioning/latest");
+                PathUtils.validatePathComponent(versioning.getRelease(), "versioning/release");
+                for (int i = 0; i < versioning.getVersions().size(); i++) {
+                    PathUtils.validatePathComponent(versioning.getVersions().get(i), "versioning/versions[" + i + "]");
+                }
+                for (int i = 0; i < versioning.getSnapshotVersions().size(); i++) {
+                    PathUtils.validatePathComponent(
+                            versioning.getSnapshotVersions().get(i).getVersion(),
+                            "versioning/snapshotVersions[" + i + "]/version");
+                }
+            }
+        }
+        return metadata;
+    }
+}

pom.xml

@@ -144,7 +144,7 @@ under the License.
     <securityDispatcherVersion>2.0</securityDispatcherVersion>
     <cipherVersion>2.0</cipherVersion>
     <jxpathVersion>1.4.0</jxpathVersion>
-    <resolverVersion>2.0.20</resolverVersion>
+    <resolverVersion>2.0.21-SNAPSHOT</resolverVersion>
     <slf4jVersion>2.0.18</slf4jVersion>
     <xmlunitVersion>2.12.0</xmlunitVersion>
     <powermockVersion>2.0.9</powermockVersion>