mcc0nnell opened a new pull request, #13117: URL: https://github.com/apache/maven/pull/13117
This fixes a compatibility edge in `MavenXpp3Reader` exposed by the current OSS-Fuzz/Jazzer `maven-model` target. Woodstox can defer malformed character-reference errors until text access. In that path it throws `WstxLazyException`, a runtime wrapper whose cause is an `XMLStreamException`. `MavenXpp3Reader` currently translates directly thrown `XMLStreamException` values to `XmlPullParserException`, but lets this lazy wrapper escape the API contract. A 53-byte reproducer is enough: ```xml <project><description>p	a9;</description></project> ``` Before this change the fuzz target exits with the escaping `WstxLazyException`. The patch translates only runtime exceptions whose cause is an `XMLStreamException`; unrelated runtime exceptions still propagate unchanged. Regression coverage exercises both the `Reader` and `InputStream` entry points. Validation performed locally: - `maven-model`: 175 tests, 0 failures - full OSS-Fuzz Maven build: all 38 reactor modules succeeded - exact reproducer: old build exits 77; patched build exits 0 - post-fix fuzz pass: 3,114,628 executions with no crash Checklist: - [x] This pull request addresses one focused issue. - [x] The commit has a meaningful subject and body. - [x] Unit tests cover the behavioral change and fail without the fix. - [ ] `mvn verify` / Core IT suite was not run locally; CI can provide the full project verification. - [x] I hereby declare this contribution to be licensed under the Apache License Version 2.0, January 2004. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
