[MSHARED-429] Supposedly invalid URLs are rendered as plain text

[jira-importer]

Jan Schultze opened MSHARED-429 and commented

org.apache.maven.reporting.AbstractMavenReportRenderer#linkPatternedText(String) from org.apache.maven.shared::maven-reporting-impl validates URLs before rendering. If the validation fails URLs are rendered as plain text. The class uses an (in recent versions) deprecated UrlValidator from commons-validator which considers unqualified (i.e. local) host names and fully qualified domain names with a top level domain longer than 4 characters as invalid (such as the special use domain .local or more recent TLDs as .academy and .paris). This makes using maven sites in a private network with a .local top level domain cumbersome as browsing (proprietary) dependencies site(s) requires users to manually copy and paste the URL.

---

Affects: maven-reporting-impl-2.3

Attachments:

• local_url_valitdation.patch (12.33 kB)

Issue Links:

• MSHARED-489 AbstractMavenReportRenderer#linkPatternedText ignores name if href is invalid

• MSHARED-609 Partially revert MSHARED-429
  ("is superceded by")

• MSHARED-611 Drop any href validation and pass as-is
  ("is superceded by")

[jira-importer]

Jan Schultze commented

I've attached a patch that will do three things

• Annotated overriden methods in test class DemoReportRenderer with @Override
• Increased the version of the commons-validator dependency from 1.3.1 to 1.4.1
• and mainly uses a second UrlValidator that accepts plain hostnames and hosts within the special use top level domain ".local".

[jira-importer]

Hervé Boutemy commented

patch applied in r1687636
most important fact are there:

• comprehensive unit tests
• general code style

there were still some code style details that I had to fix in r1687639, as reported by Checkstyle while running "msvn install"

Thank you for this great work

[jira-importer]

Michael Osipov commented

I'd seriously like to revert this partially for 3.0:

• Your DNS setup is simply broken. .local is a reserved TLD for mDNS resolution. This is not meant to be used in private networks. Doing so breaks Avahi on Linux/FreeBSD, Bonjour on macOS and everything else using zeroconf. You should register a domain name and use subdomains on your private network (https://de.wikipedia.org/wiki/Zeroconf#Multicast_DNS).
• It accepts ports > 16-bit unsigned integer
• You always have to update with the newest pattern in Commons Validator

Local hostnames (unqualified) can be validated by passing an option/flag to the validator. The rest of the patch, missing TLDs, etc. are already in Commons Validator 1.5.1.