The script automatically makes a project-supplied wrapper executable and runs it
Source references: 2The script prefers mvnw from the project directory. If it is not executable, the script applies chmod and then invokes it as a subprocess. That wrapper belongs to the repository being migrated and is not audited code from this Skill.
A tampered or untrusted repository wrapper could execute arbitrary commands with the user's privileges, read local credentials, alter files, or contact external services.
If the user runs the BOM automation on a project containing mvnw, the script prefers that repository-supplied wrapper. If it is not executable, it adds execute bits for user, group, and others, then runs it as a subprocess. Because the wrapper belongs to the project being migrated, it can execute repository-controlled code and download components. The user can require wrapper/config review, prohibit chmod, and select a trusted Maven using --mvn.
else: wrapper = os.path.join(project_dir, "mvnw") if os.path.isfile(wrapper): if not os.access(wrapper, os.X_OK): # Wrapper exists but isn't executable (common after fresh clones # on filesystems that don't preserve the +x bit). Try to fix it. try: mode = os.stat(wrapper).st_mode os.chmod(wrapper, mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH) print(f"[upgrade_bom] Added executable bit to {wrapper}.") except OSError as exc: print( f"[upgrade_bom] WARNING: mvnw exists at {wrapper} but is not " f"executable and chmod failed ({exc}); falling back to 'mvn'.", file=sys.stderr, ) return "mvn" if os.access(wrapper, os.X_OK): return wrapper return "mvn"Show 1 other places
def _run_maven_recipe(mvn_cmd: str, project_dir: str, recipe: str, options: str) -> int: """Run an OpenRewrite recipe via the rewrite-maven-plugin.""" cmd = [ mvn_cmd, "-U", f"{MVN_REWRITE_PLUGIN}:run", f"-Drewrite.recipeArtifactCoordinates={MVN_REWRITE_ARTIFACT_COORDS}", f"-Drewrite.activeRecipes={recipe}", f"-Drewrite.options={options}", ] print(f"[upgrade_bom] Running: {' '.join(cmd)}") return subprocess.run(cmd, cwd=project_dir).returncode