Summary
DependencyCollectorRequest.getConfigProperties() returns the internal backing Map<String, String> directly, so callers can mutate the request after construction without going through addConfigProperty(...)/removeConfigProperty(...). If the map is later shared or reused, this breaks the encapsulation those helpers exist to provide.
Affected code
src/main/java/org/apache/maven/shared/dependency/graph/collector/DependencyCollectorRequest.java:130-132
Impact
- External mutation bypasses the add/remove API (and any future validation/normalization added there).
- A caller holding the returned map while the request is used concurrently can observe inconsistent configuration.
Suggested fix
Return an unmodifiable copy/view from getConfigProperties() (e.g. Collections.unmodifiableMap(new HashMap<>(configProperties))) or a shallow copy, and add a test asserting the returned map cannot modify the request.
Summary
DependencyCollectorRequest.getConfigProperties()returns the internal backingMap<String, String>directly, so callers can mutate the request after construction without going throughaddConfigProperty(...)/removeConfigProperty(...). If the map is later shared or reused, this breaks the encapsulation those helpers exist to provide.Affected code
src/main/java/org/apache/maven/shared/dependency/graph/collector/DependencyCollectorRequest.java:130-132Impact
Suggested fix
Return an unmodifiable copy/view from
getConfigProperties()(e.g.Collections.unmodifiableMap(new HashMap<>(configProperties))) or a shallow copy, and add a test asserting the returned map cannot modify the request.