model validator accepts '.' and '..' as artifactId/version, creating path-traversal segments in local repository paths

[jmestwa-coder]

Affected version

4.1.0-SNAPSHOT (master); the compat maven-model-builder validator has the same gap.

Bug description

coordinate ids and versions equal to . or .. pass model validation:

• isValidCoordinatesId (maven-impl DefaultModelValidator) / isValidId (compat) check each character individually and . is an allowed character, so the strings . and .. are accepted as groupId/artifactId
• validateVersion only bans the filesystem metacharacters \/:"<>|?*, so a version of .. passes too
• same gap in the wildcard-id variant

these values are used verbatim as directory segments when an artifact is mapped to its local repository path (groupId-as-dirs/artifactId/version/artifactId-version.ext in the default layout, see DefaultRepositoryLayout.pathOf), so an artifactId or version of .. is a literal path-traversal segment.

example: this dependency passes STRICT validation

<dependency>
  <groupId>org.example</groupId>
  <artifactId>..</artifactId>
  <version>1.0</version>
</dependency>

and maps to the local-repository path

org/example/../1.0/..-1.0.jar  ->  org/1.0/..-1.0.jar

so the .. segment escapes the coordinate directory. a dependency version of .. does the same one level down (org/example/lib/../lib-...jar -> org/example/lib-...jar). any POM in the dependency graph can carry such coordinates.

groupId on its own is not a raw-segment vector since the layout maps its dots to path separators (org..evil becomes org//evil, an empty segment rather than ..), but ./.. as a whole groupId is rejected as well for consistency.

fix in #12410: reject . and .. in the id checks, the wildcard variant, and validateVersion, in both the maven-impl and compat maven-model-builder validators, with regression tests in each module.

[elharo]

Anyone remember where the normative rules for maven artifact and group IDs are written down?

[elharo]

As best I can tell on a quick search the problem is that "these values are used verbatim as directory segments when an artifact is mapped to its local repository path." I cannot find any reference that states . and .. are illegal group or artifact IDs.