Skip to content

[MNG-8129] Handle InvalidPathException for broken relativePath on Windows - #12740

Open
gnodet wants to merge 2 commits into
apache:masterfrom
gnodet:fix/MNG-8129-windows-invalid-path-master
Open

[MNG-8129] Handle InvalidPathException for broken relativePath on Windows#12740
gnodet wants to merge 2 commits into
apache:masterfrom
gnodet:fix/MNG-8129-windows-invalid-path-master

Conversation

@gnodet

@gnodet gnodet commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Catch InvalidPathException in BuildPathSource.resolve() (new API) and FileModelSource.getRelatedSource() (compat) and return null, letting the caller fall through to repository-based parent resolution
  • Adds tests for both code paths

Problem

Some POMs on Maven Central have <relativePath> set to a GAV coordinate instead of a filesystem path. For example, artemis-project-2.33.0.pom contains:

<relativePath>org.apache:apache</relativePath>

On Windows, colons are reserved for drive letters, so Path.resolve("org.apache:apache") throws InvalidPathException before any file-existence check can run. On Linux/macOS the same call succeeds (: is valid in paths), and the subsequent Files.isRegularFile() check returns false, so the invalid path is harmlessly ignored.

Approach

Catch InvalidPathException and return null — an invalid path obviously cannot point to an existing parent POM, so returning null is the correct semantic (no local parent found → fall through to repository resolution). This matches Maven 3.x behavior.

Closes #12738

🤖 Generated with Claude Code

…dows

Some POMs on Maven Central have <relativePath> set to a
groupId:artifactId coordinate (e.g. artemis-project-2.33.0.pom uses
<relativePath>org.apache:apache</relativePath>) instead of a proper
filesystem path.  On Windows, colons are reserved for drive letters,
so Path.resolve() throws InvalidPathException before any file-existence
check can run.

Catch InvalidPathException in both BuildPathSource.resolve() (new API)
and FileModelSource.getRelatedSource() (compat) and return null,
letting the caller fall through to repository-based parent resolution.
This matches Maven 3.x behavior where the file-existence check
after Path.resolve() made the invalid path harmless on all platforms.

Closes apache#12738

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@gnodet gnodet left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean backport of PR #12739 to master. Same well-scoped fix catching InvalidPathException in both the new API (BuildPathSource.resolve) and compat API (FileModelSource.getRelatedSource) paths, with tests for each.

Returning null is the right semantic — it means "no local parent found" and causes the model builder to fall through to repository-based parent resolution, matching Maven 3.x behavior.

Same minor nit as #12739: FileModelSourceTest.java line 80 uses fully-qualified org.junit.jupiter.api.Assertions.assertNull(result) instead of a static import (file already statically imports assertFalse, assertTrue, assumeTrue).

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of gnodet

Reject <relativePath> values containing characters that are illegal
in filesystem paths (: " < > | ? *) during model validation.
This catches nonsensical values like "org.apache:apache" early, with
a clear error message, complementing the InvalidPathException catch
in the resolution layer.

The check uses errOn31 severity — WARNING for compat (STRICT=3.0)
and ERROR for the new API (STRICT=4.2).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

@gnodet gnodet left a comment

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Re-reviewed after new commit 0f2e9097 adding relativePath validation for illegal filesystem characters (MNG-8129).

Verdict: APPROVE

The two commits together provide excellent defense-in-depth:

  1. Commit 1 — catches InvalidPathException at resolution time to prevent crashes on Windows when relativePath contains illegal characters.
  2. Commit 2 — adds early model validation that rejects illegal filesystem characters in relativePath before resolution is attempted.

Noteworthy design choices:

  • The severity escalation via errOn31 is well-reasoned: produces a WARNING in compat mode (Maven 3 backward compatibility) and an ERROR in impl mode (Maven 4 strict validation).
  • The validation placement differs appropriately between compat (validateRawModel) and impl (validateFileModel), matching each module's validation architecture.
  • ILLEGAL_RELATIVE_PATH_CHARS correctly excludes \ and / since directory separators are legitimate in relative paths.

Minor style observation (non-blocking): The ILLEGAL_RELATIVE_PATH_CHARS constant is hardcoded as :"<>|?* rather than derived from ILLEGAL_FS_CHARS (as done in the 3.10.x counterpart PR #12742, which uses ILLEGAL_FS_CHARS.replace("\\", "").replace("/", "")). Both produce the same character set, but the derived approach is slightly more maintainable.

Tests cover all four code paths. Clean implementation.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Invalid POM relativePath prevents Maven 4.0 from building model

1 participant