Output, transport and consumer POM robustness fixes

[slachiewicz]

Robustness fixes across the CLI, transport and consumer POM.

• Transfer listener output. Control characters in transfer messages are escaped so they render literally rather than being interpreted by the terminal. Tab and newline are preserved.
• Transport base URI. Relative locations resolve against a slash-terminated base, so a relative reference cannot resolve outside it.
• Mirror matching. isExternalRepo/isExternalHttpRepo parsed with java.net.URL, which throws on dav:, dav:http: and dav+http: — leaving those branches unreachable — and returned false on any parse failure, so an unparseable URL matched no external:* mirror. Parsing is now textual and an unparseable URL is treated as external.
• Settings decryption messages. Decryption failure messages identify the server or profile property concerned rather than including the encrypted value.
• Consumer POM repositories. The consumer POM now publishes only repositories the project's own POM declares; those present only via a parent POM or an active settings.xml profile are dropped, with a warning naming each. maven.consumer.pom.sanitizeRepositories=false restores the previous behaviour. This changes a published artifact format — see the note below.
• mvnup resolution. mvnup reused hardcoded repositories and forced user.home, so a real settings.xml was never read. It now uses the settings the CLI already loaded and the configured local repository. Where the standalone resolver cannot honour the configuration — offline mode, a redirecting mirror, an active proxy — it is given no remote repositories and the affected strategies skip their remote work with a warning.

Release note for the consumer POM change: a downstream consumer relying on inheriting a repository declaration that existed only in a parent POM or the publisher's settings will need to declare that repository itself.

Each change is a separate commit.

---

Draft while related code paths are reviewed — the same guard may be needed in sibling implementations of these interfaces, and I would rather establish that before asking for review time.

[gnodet]

Well-structured multi-topic robustness PR with genuine security and correctness improvements. All changes are well-tested with both unit and integration tests. A few minor observations:

Minor observations:

1. Style (MavenITgh10210SettingsXmlDecryptTest.java:77): assertTrue(!log.contains(...)) → assertFalse(log.contains(...)) for readability and better failure messages.

2. Logging level (DefaultConsumerPomBuilder.java:602): LOGGER.warn() for every retained repository will fire in every build that declares non-central repositories, even when the user is doing everything correctly. Consider using INFO or DEBUG for retained repositories and reserving WARN for dropped repositories.

3. Duplication (DefaultMirrorSelector.java / MavenRepositorySystem.java): The regex pattern URL_PROTOCOL_AND_HOST and the isExternalRepo/isExternalHttpRepo/isLocal methods are duplicated verbatim between the compat and core modules. A shared utility could reduce maintenance burden, though the duplication is understandable given the compat module's deprecated status.

4. Duplication (AbstractMavenTransferListener): The sanitize() method is duplicated between the impl and compat versions of this class. Consider extracting to a shared utility.

Technical notes (for other reviewers):

• The fail-closed change (return true on URL parse failure) in isExternalRepo/isExternalHttpRepo is the right security posture — unparseable URLs will now be subject to external:* and external:http:* mirror rules (including the default HTTP blocker).
• The transport URI slash normalization fixes a subtle bug where URI.resolve("foo") against http://example.com/repo resolves to http://example.com/foo instead of http://example.com/repo/foo, and prevents prefix-match false positives (e.g. repo-other matching repo).
• The DecryptingSettingsTransformer refactoring with withReference properly tracks context through nested calls and restores state in finally blocks. The reference equality check newVal != entry.getValue() is intentional and correct.
• The consumer POM repository sanitization correctly collects declared repository IDs from both model-level and profile-level, with a proper opt-out via maven.consumer.pom.sanitizeRepositories=false.
• The mvnup remote-resolution gate correctly identifies offline mode, redirecting mirrors, and active proxies as scenarios where standalone resolution cannot honor operator settings.
• The possessive quantifier {2,}+ in the URL regex prevents ReDoS.

---

_{🤖 This review was generated by ForgeBot.}