Revert restricted interpolation for repository-resolved models - #13030
Revert restricted interpolation for repository-resolved models#13030gnodet wants to merge 1 commit into
Conversation
The restricted interpolation introduced in 03c947d prevents user, system and environment properties from being resolved in models built at VALIDATION_LEVEL_MINIMAL (dependency, parent and BOM-import POMs). While the intent was to prevent property leaking from the requesting build into transitive POMs, it breaks systemPath resolution: system- scoped dependencies in repository-resolved models use properties like ${test.home}, ${env.JAVA_HOME} etc. to construct absolute paths to local JARs, and those must be interpolated against the build session. Leaving them unresolved causes the absolute-path validation on systemPath to fail, breaking four integration tests on every platform and JDK combination: - MavenIT0085TransitiveSystemScopeTest - MavenITmng3586SystemScopePluginDependencyTest - MavenITmng4379TransitiveSystemPathInterpolatedWithEnvVarTest - MavenITmng4590ImportedPomUsesSystemAndUserPropertiesTest This commit reverts the interpolation restriction while keeping the profile activation restrictions (no file/property-based profile activation and no repository injection from profiles in external models) which are the real security hardening from that commit.
gnodet
left a comment
gnodet
left a comment
There was a problem hiding this comment.
Clean selective revert of the interpolation restriction from commit 03c947d820. The diff is the exact inverse of the combined interpolation changes from the three contributing commits (155 deleted lines match 155 added, 9 restored match 9 removed). Profile activation restrictions from the same commit series are correctly preserved — the meaningful security hardening remains intact.
The approach is sound: the interpolation restriction fundamentally conflicts with systemPath resolution, which requires env/user/system properties to construct absolute paths. All 12 CI jobs pass.
📋 PR Metadata
| Aspect | Current | Suggested |
|---|---|---|
| Labels | (none) | bug |
| Milestone | (none) | 3.10.0 |
This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.
Claude Code on behalf of Guillaume Nodet
|
Closing — the fix should be in maven-integration-testing instead, to match what was done on master/4.0.x (where the ITs were updated to use -Dmaven.model.dependencyInterpolation.full=true). |
1 participant
The restricted property interpolation introduced in 03c947d prevents user, system and environment properties from being resolved in models built at
VALIDATION_LEVEL_MINIMAL(dependency, parent and BOM-import POMs). While the intent was to prevent property leaking from the requesting build into transitive POMs, it breakssystemPathresolution.System-scoped dependencies in repository-resolved models use properties like
${test.home},${env.JAVA_HOME}, etc. to construct absolute paths to local JARs, and those must be interpolated against the build session. Leaving them unresolved causes the absolute-path validation onsystemPathto fail.This breaks all integration tests across every platform (ubuntu, windows, macOS) and JDK (8, 25, 26):
MavenIT0085TransitiveSystemScopeTestMavenITmng3586SystemScopePluginDependencyTestMavenITmng4379TransitiveSystemPathInterpolatedWithEnvVarTestMavenITmng4590ImportedPomUsesSystemAndUserPropertiesTestThis commit reverts only the interpolation restriction while keeping the profile activation restrictions from that commit (no file/property-based profile activation and no repository injection from profiles in external models), which are the meaningful security hardening.