Maven: Handle Malformed expressions or Invalid values present in properties section of the pom.xml file

[thavaahariharangit]

Problem:
How to handle the Malformed expression?

Solution provided :
As per the maven documentation, properties can contain any values. So if it is an expression then we should treat it as an expression and find the value of it, else we need to treat that as regular value.

Property value can accept

1. Expression ${exp}
2. Booleans
3. Version numbers in any format
4. Date Time formats and etc.

Ref :
https://maven.apache.org/pom.html#Properties
https://maven.apache.org/guides/introduction/introduction-to-the-pom.html

[jurre]

Maven itself seems to raise an error when finding an invalid expression, should we maybe do the same? The downside of doing it is that there might be some repo's where Dependabot can currently open PRs with updates whereas when we start raising an error, we won't. But on the other hand, since those project's won't be valid for Maven anyway, does it really matter?

[thavaahariharangit]

Maven itself seems to raise an error when finding an invalid expression, should we maybe do the same? The downside of doing it is that there might be some repo's where Dependabot can currently open PRs with updates whereas when we start raising an error, we won't. But on the other hand, since those project's won't be valid for Maven anyway, does it really matter?

If it is lombok.version (commercially available dependency), then maven is identifying that it is not available value by checking against available lombok versions in their repo and raising : ERROR] The project com.dependabot.testing:dependabot-demo:0.0.1-SNAPSHOT (/Users/hariharanthavachelvam/Documents/Sites/Demo/dependabot-demo/pom.xml) has 1 error [ERROR] 'dependencies.dependency.version' for org.projectlombok:lombok:jar must be a valid version but is '${tag.version'. @ line 35, column 13

but when I use the tag name as tag.version(totally custom tag then ) <tag.version>${tag.version</tag.version> even the maven build is succeeding. (This fix, will stop dependabot raising an error at this scenario.)

So the maven is, validating against the available version in their dependency repo.

But in general term Properties are allowed to have any values.

That is why I left as it is.