Add support for different Maven POM encoding (#25873) (#25890)

Backport #25873 by @KN4CK3R

Fixes #25853

- Maven POM files aren't always UTF-8 encoded.
- Reject the upload of unparsable POM files

Co-authored-by: KN4CK3R <admin@oldschoolhack.me>

modules/packages/maven/metadata.go

@@ -8,6 +8,8 @@ import (
 	"io"
 
 	"code.gitea.io/gitea/modules/validation"
+
+	"golang.org/x/net/html/charset"
 )
 
 // Metadata represents the metadata of a Maven package
@@ -52,7 +54,10 @@ type pomStruct struct {
 // ParsePackageMetaData parses the metadata of a pom file
 func ParsePackageMetaData(r io.Reader) (*Metadata, error) {
 	var pom pomStruct
-	if err := xml.NewDecoder(r).Decode(&pom); err != nil {
+
+	dec := xml.NewDecoder(r)
+	dec.CharsetReader = charset.NewReaderLabel
+	if err := dec.Decode(&pom); err != nil {
 		return nil, err
 	}
 

modules/packages/maven/metadata_test.go

@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"golang.org/x/text/encoding/charmap"
 )
 
 const (
@@ -69,4 +70,20 @@ func TestParsePackageMetaData(t *testing.T) {
 		assert.Equal(t, dependencyArtifactID, m.Dependencies[0].ArtifactID)
 		assert.Equal(t, dependencyVersion, m.Dependencies[0].Version)
 	})
+
+	t.Run("Encoding", func(t *testing.T) {
+		// UTF-8 is default but the metadata could be encoded differently
+		pomContent8859_1, err := charmap.ISO8859_1.NewEncoder().String(
+			strings.ReplaceAll(
+				pomContent,
+				`<?xml version="1.0"?>`,
+				`<?xml version="1.0" encoding="ISO-8859-1"?>`,
+			),
+		)
+		assert.NoError(t, err)
+
+		m, err := ParsePackageMetaData(strings.NewReader(pomContent8859_1))
+		assert.NoError(t, err)
+		assert.NotNil(t, m)
+	})
 }

routers/api/packages/maven/maven.go

@@ -49,6 +49,11 @@ var (
 
 func apiError(ctx *context.Context, status int, obj any) {
 	helper.LogAndProcessError(ctx, status, obj, func(message string) {
+		// The maven client does not present the error message to the user. Log it for users with access to server logs.
+		if status == http.StatusBadRequest || status == http.StatusInternalServerError {
+			log.Error(message)
+		}
+
 		ctx.PlainText(status, message)
 	})
 }
@@ -326,7 +331,8 @@ func UploadPackageFile(ctx *context.Context) {
 		var err error
 		pvci.Metadata, err = maven_module.ParsePackageMetaData(buf)
 		if err != nil {
-			log.Error("Error parsing package metadata: %v", err)
+			apiError(ctx, http.StatusBadRequest, err)
+			return
 		}
 
 		if pvci.Metadata != nil {

routers/web/repo/release.go

@@ -196,7 +196,6 @@ func releasesOrTags(ctx *context.Context, isTagList bool) {
 	}
 
 	ctx.Data["Releases"] = releases
-	ctx.Data["ReleasesNum"] = len(releases)
 
 	pager := context.NewPagination(int(count), opts.PageSize, opts.Page, 5)
 	pager.SetDefaultParams(ctx)

templates/repo/release_tag_header.tmpl

@@ -5,7 +5,7 @@
 	<div class="gt-df">
 		<div class="gt-f1 gt-df gt-ac">
 			<h2 class="ui compact small menu header small-menu-items">
-				<a class="{{if .PageIsReleaseList}}active {{end}}item" href="{{.RepoLink}}/releases">{{.locale.PrettyNumber .ReleasesNum}} {{.locale.TrN .ReleasesNum "repo.release" "repo.releases"}}</a>
+				<a class="{{if .PageIsReleaseList}}active {{end}}item" href="{{.RepoLink}}/releases">{{.locale.PrettyNumber .NumReleases}} {{.locale.TrN .NumReleases "repo.release" "repo.releases"}}</a>
 				{{if $canReadCode}}
 					<a class="{{if .PageIsTagList}}active {{end}}item" href="{{.RepoLink}}/tags">{{.locale.PrettyNumber .NumTags}} {{.locale.TrN .NumTags "repo.tag" "repo.tags"}}</a>
 				{{end}}