XML prolog being anything other than <?xml ... ?> results in NPE

[lukehutch]

I have the following m2e directive in my pom.xml:

<?m2e execute onConfiguration,onIncremental?>

The Scrutinizer CI gives this error:

Running mvn org.sonarsource.scanner.maven:sonar-maven-plugin:3.3.0.603:sonar :
====================================================================
[INFO] Scanning for projects...
[ERROR] Internal error: java.lang.ArrayIndexOutOfBoundsException: 9751 -> [Help 1]
org.apache.maven.InternalErrorException: Internal error: java.lang.ArrayIndexOutOfBoundsException: 9751
	at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:121)
	at org.apache.maven.cli.MavenCli.execute(MavenCli.java:862)
	at org.apache.maven.cli.MavenCli.doMain(MavenCli.java:286)
	at org.apache.maven.cli.MavenCli.main(MavenCli.java:197)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:289)
	at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:229)
	at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode(Launcher.java:415)
	at org.codehaus.plexus.classworlds.launcher.Launcher.main(Launcher.java:356)
Caused by: java.lang.ArrayIndexOutOfBoundsException: 9751
	at org.codehaus.plexus.util.xml.pull.MXParser.parsePI(MXParser.java:2502)
	at org.codehaus.plexus.util.xml.pull.MXParser.nextImpl(MXParser.java:1283)
	at org.codehaus.plexus.util.xml.pull.MXParser.next(MXParser.java:1131)
	at org.codehaus.plexus.util.xml.pull.MXParser.nextTag(MXParser.java:1116)
	at org.apache.maven.model.io.xpp3.MavenXpp3ReaderEx.parsePlugin(MavenXpp3ReaderEx.java:3025)
	at org.apache.maven.model.io.xpp3.MavenXpp3ReaderEx.parsePluginManagement(MavenXpp3ReaderEx.java:3362)
	at org.apache.maven.model.io.xpp3.MavenXpp3ReaderEx.parseBuild(MavenXpp3ReaderEx.java:977)
	at org.apache.maven.model.io.xpp3.MavenXpp3ReaderEx.parseModel(MavenXpp3ReaderEx.java:2512)
	at org.apache.maven.model.io.xpp3.MavenXpp3ReaderEx.read(MavenXpp3ReaderEx.java:4350)
	at org.apache.maven.model.io.xpp3.MavenXpp3ReaderEx.read(MavenXpp3ReaderEx.java:560)
	at org.apache.maven.model.io.DefaultModelReader.read(DefaultModelReader.java:121)
	at org.apache.maven.model.io.DefaultModelReader.read(DefaultModelReader.java:94)
	at org.apache.maven.model.building.DefaultModelProcessor.read(DefaultModelProcessor.java:81)
	at org.apache.maven.model.building.DefaultModelBuilder.readModel(DefaultModelBuilder.java:529)
	at org.apache.maven.model.building.DefaultModelBuilder.build(DefaultModelBuilder.java:269)
	at org.apache.maven.project.DefaultProjectBuilder.build(DefaultProjectBuilder.java:469)
	at org.apache.maven.project.DefaultProjectBuilder.build(DefaultProjectBuilder.java:438)
	at org.apache.maven.project.DefaultProjectBuilder.build(DefaultProjectBuilder.java:401)
	at org.apache.maven.graph.DefaultGraphBuilder.collectProjects(DefaultGraphBuilder.java:419)
	at org.apache.maven.graph.DefaultGraphBuilder.getProjectsForMavenReactor(DefaultGraphBuilder.java:410)
	at org.apache.maven.graph.DefaultGraphBuilder.build(DefaultGraphBuilder.java:83)
	at org.apache.maven.DefaultMaven.buildGraph(DefaultMaven.java:491)
	at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:219)
	at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:193)
	at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:106)
	... 11 more

The relevant code is here, and seems not to properly handle anything other than xml after <?:

https://github.com/sonatype/plexus-utils/blob/master/src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java#L2489

Instead, the code should skip anything after <? until it finds ?>, in order to support the use of XML processing instructions:

https://www.w3.org/TR/xml/#sec-pi

As an aside, the MXParser class is pretty horrendous -- why was this parser hand-coded in a highly nonconventional style, reinventing the parsing wheel poorly, rather than using a parser generator, or even better, simply using an XML parsing library?

[lukehutch]

To fix this I had to replace

command: java-sonar-run

with

command: sed -i .bak "s/<?/<!-- /;s/?>/ -->/" pom.xml && java-sonar-run

in my Scrutinizer configuration.

[hboutemy]

did you try to upgrade to plexus-utils 3.3.0 from the reference repository https://github.com/codehaus-plexus/plexus-utils ?
(this repository at Sonatype should definitely be archived...)

[lukehutch]

I didn't... I'm using https://scrutinizer-ci.com/ , so I don't control what version they use of plexus-utils. However, given how old the MXParser parser code is, and how little it appears to have been changed over the years based on the change history, I don't anticipate that this bug is fixed yet.

[hboutemy]

it has evolved
now do as you wish, just know that nothing will happen in this Git repository

[lukehutch]

OK. Maybe delete this repository then, if it is just a stale fork of the upstream project?