Fix #13084: allow negated-property profiles in external model builds - #13095
Open
gnodet wants to merge 1 commit into
Open
Fix #13084: allow negated-property profiles in external model builds#13095gnodet wants to merge 1 commit into
gnodet wants to merge 1 commit into
Conversation
…uilds A profile whose activation uses a negated property condition (<name>!foo</name>, no value) fires when the property is *absent* — the common "opt-out flag" idiom. Such profiles are on by default and can only be suppressed (by setting the property), never injected by supplying one. They do not present the security risk that motivated the file/property filter in withoutFileAndPropertyActivation() (commit 03c947d). The previous implementation treated *all* property conditions as unsafe and filtered them out of external model builds. This broke effective model construction for any POM that relied on negated-property profiles to inject dependency versions — resteasy-client:7.0.0.Final is a canonical example (its resteasy-default profile activates on <!resteasy.dependencies.eap>). When those versions were missing, the effective-model validator reported them as errors and threw a ModelBuildingException. Fix: both the compat (DefaultModelBuilder) and the Maven 4 impl (DefaultModelBuilder / hasFileOrPropertyOrConditionActivation) now treat a negated-name-only property condition as environment- independent and allow it through. All other property conditions (positive name, or a required value) remain blocked. The existing repository-stripping step is unaffected, so external models still cannot inject repositories. Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Profiles activated by a negated property condition (
<name>!foo</name>, no value) fire when the property is absent — the classic "opt-out flag" idiom. Such profiles are on by default and can only be suppressed (by setting the property), never injected by supplying one.The previous implementation treated all property conditions as unsafe and filtered them out of external model builds (
withoutFileAndPropertyActivation/hasFileOrPropertyOrConditionActivation). This broke effective model construction for any POM that relies on negated-property profiles to inject dependency versions —resteasy-client:7.0.0.Finalis a canonical example (itsresteasy-defaultprofile activates on!resteasy.dependencies.eap). When those versions were missing, the effective-model validator reported them as errors and threwModelBuildingException.Root cause
The filter introduced in commit
03c947d8to prevent environment-controlled profiles from injecting repositories into external models blocked negated-property activations as a side effect. Negated conditions are the opposite of the threat model: an attacker cannot force them on — they are already on by default.Fix
Both the compat (
DefaultModelBuilder) and the Maven 4 impl (DefaultModelBuilder/hasFileOrPropertyOrConditionActivation) now treat a negated-name-only property condition as environment-independent and allow it through the filter. All other property conditions (positive name, or a required value) remain blocked. The existing repository-stripping step is unaffected — external models still cannot inject repositories.Test
Added
negatedPropertyActivatedProfileIsPreservedInExternalModelBuild()toDefaultModelBuilderTest: builds a POM inVALIDATION_LEVEL_MINIMALmode (the same level used by the artifact descriptor reader) with a profile activated by!skip.defaults; verifies that the profile activates and its dependency appears in the effective model.Fixes #13084
Hermes Agent (Claude Sonnet 4.6) on behalf of Guillaume Nodet