gnodet opened a new pull request, #12739: URL: https://github.com/apache/maven/pull/12739
## Summary - Catch `InvalidPathException` in `FileModelSource.getRelatedSource()` (compat) and `BuildPathSource.resolve()` (new API) and return `null`, letting the caller fall through to repository-based parent resolution - Adds tests for both code paths ## Problem Some POMs on Maven Central have `<relativePath>` set to a GAV coordinate instead of a proper filesystem path. For example, [`artemis-project-2.33.0.pom`](https://repo.maven.apache.org/maven2/org/apache/activemq/artemis-project/2.33.0/artemis-project-2.33.0.pom) contains: ```xml <relativePath>org.apache:apache</relativePath> ``` On Windows, colons are reserved for drive letters, so `Path.resolve("org.apache:apache")` throws `InvalidPathException` before any file-existence check can run. On Linux/macOS the same call succeeds (`:` is valid in paths), and the subsequent `Files.isRegularFile()` check returns `false`, so the invalid path is harmlessly ignored. Maven 3.x accidentally handled this because the `Path.resolve()` call in `FileModelSource.getRelatedSource()` would succeed on all CI platforms (Linux), and the file-existence check made it a no-op. Maven 4 introduced `PathSource.resolve()` / `BuildPathSource.resolve()` which has the same vulnerability but is now also exercised on Windows CI. ## Approach Catch `InvalidPathException` in both resolve methods and return `null` — an invalid path obviously cannot point to an existing parent POM, so returning `null` is the correct semantic (no local parent found → fall through to repository resolution). Closes #12738 Closes #10492 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
