chore: harden embedded-POM trust boundary in install:install-file

[gnodet]

Summary

Hardens the embedded-POM trust boundary in install:install-file, addressing four findings from a static security audit of the Maven 4 line (commit 0bfcb64).

Findings addressed

ID	Severity	Title
f001	MEDIUM	Embedded JAR POM silently chooses install coordinates, poisoning shared local repo
f002	MEDIUM	Foreign embedded POM installed verbatim even with explicit CLI coordinates
f003	LOW	Defense-in-depth DOCTYPE rejection for attacker-authored embedded POM
f004	LOW	Coordinate validators accept dot-only and empty segments, escaping coordinate directory

Changes

• Coordinate adoption visibility (f001): Fail when multiple META-INF/maven/*/pom.xml entries match; validate entry-path <g>/<a> against the embedded POM's effective GAV; log adopted coordinates at INFO (was DEBUG); WARN before overwriting an existing local-repo artifact with different content; validate packaging with the same rules as other coordinates.
• CLI-coordinate priority (f002): When the operator supplies complete g/a/v/packaging, skip readingPomFromJarFile() entirely and generate a minimal POM. When partial coordinates are supplied, cross-check each against the embedded POM and fail on mismatch.
• DOCTYPE screening (f003): Pre-scan embedded POM bytes for <!DOCTYPE before handing them to ModelXmlFactory.read(). Encoding-aware: BOM/first-bytes/XML-declaration sniffer covering UTF-8/16/32 and EBCDIC, with fail-closed handling for unsupported encodings and unterminated declarations.
• Coordinate validation (f004): isValidId() rejects empty and dot-only values; new isValidGroupId() rejects leading/trailing/consecutive dots; isValidVersion() rejects empty and dot-only values. Defense in depth: composed layout path must reside under the local repository root.

Category

Security hardening — no live exploit demonstrated; static-analysis findings from a 5-lane audit with blind triage panel.

Test plan

• All new unit tests pass (coordinate adoption, entry-path mismatch, multiple POM entries, invalid packaging, DOCTYPE rejection in UTF-8/UTF-16LE/UTF-16BE/EBCDIC/padded-declaration, leading-dot groupId, consecutive-dot groupId, dot-dot artifactId, dot-dot version, full-coordinates hostile POM ignored, partial-coordinates mismatch rejected, partial-coordinates match accepted)
• Existing tests pass unchanged
• mvn clean install -B succeeds

🤖 Generated with Claude Code