ascheman opened a new issue, #11978:
URL: https://github.com/apache/maven/issues/11978
## Summary
The Maven 4 `mvn` shell script uses `eval exec "$cmd"` to launch the JVM.
This causes the shell to expand `${...}` patterns in user-provided CLI
arguments,
breaking any argument that contains Maven property placeholders like
`${surefire.threadNumber}` or `${project.basedir}`.
Maven 3's `mvn` script uses `exec ... "$@"` which passes arguments verbatim.
## Reproducer
```sh
mvn validate -DtestProp='value_${some.placeholder}'
# Maven 3: works fine, passes the literal string to Java
# Maven 4: /path/to/mvn: line 302: bad substitution
```
## Root cause
In `apache-maven/src/assembly/maven/bin/mvn`
([lines
278-302](https://github.com/apache/maven/blob/a5558f892d/apache-maven/src/assembly/maven/bin/mvn#L278-L302)):
```sh
for arg in "$@"; do
cmd="$cmd \"$arg\""
done
eval exec "$cmd"
```
User arguments are concatenated into the `cmd` string.
When `eval` executes it, the shell re-parses the entire string and expands
`${...}` as shell variables.
Maven 3's approach (`exec ... "$@"`) passes arguments directly without
re-interpretation.
## Impact
This affects any Maven plugin that passes `${...}` placeholders via `-D`
system properties on the command line. Known affected tests in
maven-surefire:
- [`ForkCountIT.java` line
161](https://github.com/apache/maven-surefire/blob/98cfb3d78b4485639f12af89b88aa5f9d8aef615/surefire-its/src/test/java/org/apache/maven/surefire/its/ForkCountIT.java#L161)
— passes
`-DtestProperty=testValue_${surefire.threadNumber}_${surefire.forkNumber}`
- [`ForkCountMultiModuleIT.java` line
126](https://github.com/apache/maven-surefire/blob/98cfb3d78b4485639f12af89b88aa5f9d8aef615/surefire-its/src/test/java/org/apache/maven/surefire/its/ForkCountMultiModuleIT.java#L126)
— same pattern
- `ForkCountTestNGIT` — extends `ForkCountIT`
20 maven-surefire integration tests fail with `bad substitution` when run
with
Maven 4. See also apache/maven-surefire#3345.
## Proposed fix
Keep `eval` for the base command (needed for `$MAVEN_OPTS` word splitting)
but pass user arguments directly via `"$@"`:
```sh
# before:
for arg in "$@"; do
cmd="$cmd \"$arg\""
done
eval exec "$cmd"
# after:
eval exec "$cmd" '"$@"'
```
Verified locally: all 20 `bad substitution` errors eliminated.
`MAVEN_OPTS` word splitting and arguments with spaces continue to work
correctly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
