Honour configured policy and validate inputs on the legacy compat paths

[gnodet]

Summary

Backport of the path traversal and checksum policy fixes from #12945 (maven-4.0.x) to maven-3.10.x.

• Path traversal validation on repository keys: AbstractRepositoryMetadata.getLocalFilename and LegacyLocalRepositoryManager.ArtifactMetadataAdapter.getLocalFilename now reject a repository key that is .., contains /, \, :, or an ISO control character before using it in a local file name.
• Version token validation in metadata: DefaultRepositoryMetadataManager.readMetadata validates every version token carried by parsed repository metadata (latest, release, versions, snapshot versions, snapshot timestamp) for the same path traversal characters.
• Checksum policy enforcement: DefaultRepositoryMetadataManager.resolve now catches ChecksumFailedException separately and fails metadata resolution under checksumPolicy=fail instead of downgrading to a warning. The update-check file is only touched on success, not-found, or generic transfer failure, so checksum failures are retried on the next build. getArtifactMetadataFromDeploymentRepository and LegacyRepositorySystem.retrieve resolve the effective policy from the repository configuration instead of hardcoding warn.

The proxy clone fix (DefaultSettingsDecrypter) is already present on maven-3.10.x and is therefore not included here.

Adapted for the 3.10.x module structure (no compat/ prefix) and API differences (MetadataXpp3Reader instead of MetadataStaxReader, no pattern matching instanceof).

Test plan

• AbstractRepositoryMetadataTest (4 tests): repo keys with /, \, .., : are rejected; well-formed key produces correct filename
• LegacyLocalRepositoryManagerTest (3 tests): repo keys with path separators and .. are rejected in the inner adapter
• DefaultRepositoryMetadataManagerValidationTest (2 tests): metadata with invalid version token (colon) and invalid snapshot timestamp (colon) are rejected
• DefaultRepositoryMetadataManagerTest (1 test): resolve() throws RepositoryMetadataResolutionException when checksum policy is fail and checksums do not match
• LegacyRepositorySystemTest.testRetrieveHonorsConfiguredFailChecksumPolicy: retrieve() throws ArtifactTransferFailedException when checksum policy is fail
• mvn verify -pl maven-core -B passes
• mvn verify -pl maven-compat -B passes

🤖 Generated with Claude Code

[gnodet]

Clean, faithful backport of the approved #12945 security hardening to maven-3.10.x. All adaptations for the 3.10.x module layout and API surface are correct; no logic drift from the source PR.

Adaptations verified:

• Module paths correctly split between maven-core/ (AbstractRepositoryMetadata, LegacyLocalRepositoryManager) and maven-compat/ (DefaultRepositoryMetadataManager, LegacyRepositorySystem)
• Java language level adapted: traditional instanceof + cast instead of 4.0.x pattern matching
• Reader API adapted: ValidatingMetadataXpp3Reader (XPP3-based) instead of 4.0.x MetadataStaxReader (StAX-based)
• Proxy clone-before-decrypt correctly omitted: confirmed DefaultSettingsDecrypter on 3.10.x already has server.clone() and proxy.clone()
• ChecksumFailedException extends TransferFailedException catch ordering correct
• updateCheckManager.touch() relocation from finally to individual paths identical to 4.0.x logic
• checksumRank() ranking (fail=2, warn=1, ignore=0) identical to 4.0.x

Observation (non-blocking):

• [low] isInvalidPathToken helper duplicated between AbstractRepositoryMetadata and LegacyLocalRepositoryManager.ArtifactMetadataAdapter — same as 4.0.x, acceptable for backport.

📋 PR Metadata

Aspect	Current	Suggested
Labels	(none)	bug
Milestone	(none)	3.10.0

🔀 Backport Status

✅ All branches covered:

• maven-4.0.x → #12945 (OPEN)
• master → #12950 (OPEN)

---

This review was generated by an AI agent (Claude Code) and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of Guillaume Nodet