From ba52eff484de236baae5e0361b4b2128006dd928 Mon Sep 17 00:00:00 2001
From: Joerg Hoh <jhoh@adobe.com>
Date: Wed, 23 Jul 2025 12:47:55 +0200
Subject: [PATCH 01/10] JCRVLT-810 initial approach

---
 .../fs/config/DefaultWorkspaceFilter.java     | 14 ++++++++++
 .../vault/fs/config/package-info.java         |  2 +-
 .../jackrabbit/vault/fs/io/ImportOptions.java | 28 ++++++++++++++++++-
 .../jackrabbit/vault/fs/io/Importer.java      |  5 ++++
 .../jackrabbit/vault/fs/io/package-info.java  |  2 +-
 .../vault/packaging/package-info.java         |  2 +-
 6 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
index 4cda709fa..2fd317c0a 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
@@ -105,6 +105,11 @@ public class DefaultWorkspaceFilter implements Dumpable, WorkspaceFilter {
      */
     private ImportMode importMode;
 
+    /**
+     * skip filter checks when importing content
+     */
+    private boolean skipFilterChecksOnImport = false;
+
     /**
      * Add a #PathFilterSet for nodes items.
      * @param set the set of filters to add.
@@ -232,6 +237,10 @@ public void setImportMode(ImportMode importMode) {
         this.importMode = importMode;
     }
 
+    public void setSkipFilterChecksOnImport(boolean skipFilterChecksOnImport) {
+        this.skipFilterChecksOnImport = skipFilterChecksOnImport;
+    }
+
     /**
      * {@inheritDoc}
      */
@@ -264,6 +273,11 @@ public boolean covers(String path) {
 
     @Override
     public boolean includesProperty(String propertyPath) {
+        if (skipFilterChecksOnImport) {
+            // skip the filter checks if requested; assume that the package only includes content
+            // which matches the filters.
+            return true;
+        }
         if (!covers(propertyPath)) {
             // include all properties that are not covered by any filter. this is to ensure that the ancestor paths
             // have at least jcr:primary type.
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/package-info.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/package-info.java
index a29b5cbfa..5794b22a8 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/package-info.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/package-info.java
@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-@Version("2.9.0")
+@Version("2.10.0")
 package org.apache.jackrabbit.vault.fs.config;
 
 import org.osgi.annotation.versioning.Version;
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
index 36fde847e..9ef65dd95 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
@@ -73,6 +73,8 @@ public class ImportOptions {
 
     private Boolean overwritePrimaryTypesOfFolders = null;
 
+    private Boolean skipFilterChecksOnImport = false;
+
     /**
      * Default constructor.
      */
@@ -105,6 +107,7 @@ public ImportOptions(ImportOptions base) {
             dependencyHandling = base.dependencyHandling;
             idConflictPolicy = base.idConflictPolicy;
             overwritePrimaryTypesOfFolders = base.overwritePrimaryTypesOfFolders;
+            skipFilterChecksOnImport = base.skipFilterChecksOnImport;
         }
     }
 
@@ -132,6 +135,7 @@ public ImportOptions copy() {
         ret.dependencyHandling = dependencyHandling;
         ret.idConflictPolicy = idConflictPolicy;
         ret.overwritePrimaryTypesOfFolders = overwritePrimaryTypesOfFolders;
+        ret.skipFilterChecksOnImport = skipFilterChecksOnImport;
         return ret;
     }
 
@@ -480,6 +484,24 @@ public void setIdConflictPolicy(@NotNull IdConflictPolicy idConflictPolicy) {
         this.idConflictPolicy = idConflictPolicy;
     }
 
+    /**
+     * Allows to skip filter checks when importing content; you can set this
+     * to {{code true}} if you are sure that there this package contains no content
+     * which would be rejected by filters
+     * @param skipFilterChecksOnImport if true skip the checks
+     */
+    public void setSkipFilterChecksOnImport (boolean skipFilterChecksOnImport) {
+        this.skipFilterChecksOnImport = skipFilterChecksOnImport;
+    }
+
+    /**
+     * get the filter check skip policy
+     * @return true if the filter check is skipped
+     */
+    public boolean getskipFilterChecksOnImport() {
+        return this.skipFilterChecksOnImport;
+    }
+
     @Override
     public int hashCode() {
         final int prime = 31;
@@ -502,6 +524,7 @@ public int hashCode() {
         result = prime * result + ((idConflictPolicy == null) ? 0 : idConflictPolicy.hashCode());
         result = prime * result + (strict ? 1231 : 1237);
         result = prime * result + (overwritePrimaryTypesOfFolders ? 1231 : 1237);
+        result = prime * result + (skipFilterChecksOnImport ? 1231 : 1237);
 
         return result;
     }
@@ -575,6 +598,8 @@ public boolean equals(Object obj) {
                 return false;
         } else if (!idConflictPolicy.equals(other.idConflictPolicy))
             return false;
+        if (skipFilterChecksOnImport != other.skipFilterChecksOnImport)
+            return false;
         return true;
     }
 
@@ -592,6 +617,7 @@ public String toString() {
                 + (pathMapping != null ? "pathMapping=" + pathMapping + ", " : "")
                 + (dependencyHandling != null ? "dependencyHandling=" + dependencyHandling + ", " : "")
                 + "overwritePrimaryTypesOfFolders=" + overwritePrimaryTypesOfFolders + ", "
-                + "idConflictPolicy=" + (idConflictPolicy != null ? idConflictPolicy : IdConflictPolicy.FAIL) + "]";
+                + "idConflictPolicy=" + (idConflictPolicy != null ? idConflictPolicy : IdConflictPolicy.FAIL) + "],"
+                + "skipFilterChecksOnImport=" + skipFilterChecksOnImport;
     }
 }
\ No newline at end of file
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java
index 844e1aa26..8a9e66ff5 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java
@@ -494,6 +494,11 @@ public void run(Archive archive, Session session, String parentPath)
                 log.warn("Unable to override import mode, incompatible filter: {}", filter.getClass().getName());
             }
         }
+        if (filter instanceof DefaultWorkspaceFilter) {
+            ((DefaultWorkspaceFilter) filter).setSkipFilterChecksOnImport(opts.getskipFilterChecksOnImport());
+        } else {
+            log.warn("Unable to overwrite 'skipFilterChecksOnImport', incompatible filter: {}", filter.getClass().getName());
+        }
         // build filter tree
         for (PathFilterSet set: filter.getFilterSets()) {
             filterTree.put(set.getRoot(), set);
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/package-info.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/package-info.java
index 9783d907f..8f991720e 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/package-info.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/package-info.java
@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-@Version("2.16.0")
+@Version("2.17.0")
 package org.apache.jackrabbit.vault.fs.io;
 
 import org.osgi.annotation.versioning.Version;
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/package-info.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/package-info.java
index ae88c4a99..b9b1ec4eb 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/package-info.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/package-info.java
@@ -15,7 +15,7 @@
  * limitations under the License.
  */
 
-@Version("2.16.0")
+@Version("2.17.0")
 package org.apache.jackrabbit.vault.packaging;
 
 import org.osgi.annotation.versioning.Version;

From 13245e579c242faa211948d57903002061921ab5 Mon Sep 17 00:00:00 2001
From: Joerg Hoh <jhoh@adobe.com>
Date: Wed, 23 Jul 2025 16:16:15 +0200
Subject: [PATCH 02/10] JCRVLT-810 add integration tests

---
 .../vault/packaging/integration/ImportIT.java |  27 ++++++++++++++++++
 .../tmp-content-outside-filters.zip           | Bin 0 -> 5104 bytes
 2 files changed, 27 insertions(+)
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/tmp-content-outside-filters.zip

diff --git a/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java b/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java
index 0cfef3f34..9dc139c95 100644
--- a/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java
+++ b/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java
@@ -445,4 +445,31 @@ public void testEnhancedFileAggregatePackageWithIntermediateSaves() throws IOExc
         assertPropertyExists("/testroot/tika/config.xml/jcr:content/jcr:data");
         assertProperty("/testroot/tika/config.xml/jcr:content/jcr:mimeType", "text/xml");
     }
+
+    @Test
+    public void testSkipFilterChecksOnImport_disabled() throws Exception {
+        ImportOptions opts = getDefaultOptions();
+        Importer importer = new Importer(opts);
+        try (Archive archive = getFileArchive("/test-packages/tmp-content-outside-filters.zip")) {
+            archive.open(true);
+            importer.run(archive, admin.getRootNode());
+            admin.save();
+        }
+        assertNodeExists("/tmp/foo");
+        assertPropertyMissing("/tmp/foo/bar/tobi/excludeddProp");
+    }
+
+    @Test
+    public void testSkipFilterChecksOnImport_enabled() throws Exception {
+        ImportOptions opts = getDefaultOptions();
+        opts.setSkipFilterChecksOnImport(true);
+        Importer importer = new Importer(opts);
+        try (Archive archive = getFileArchive("/test-packages/tmp-content-outside-filters.zip")) {
+            archive.open(true);
+            importer.run(archive, admin.getRootNode());
+            admin.save();
+        }
+        assertNodeExists("/tmp/foo");
+        assertPropertyExists("/tmp/foo/bar/tobi/excludedProp");
+    }
 }
\ No newline at end of file
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/tmp-content-outside-filters.zip b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/tmp-content-outside-filters.zip
new file mode 100644
index 0000000000000000000000000000000000000000..c852c60e18f9fd019704dfbc18c5577373915048
GIT binary patch
literal 5104
zcma)A2{@GN7yoRTtQp3haHEiYiHKB|ERo4lmJp*c7|YlzWeHg#%O%kbMOiA>GL}h}
zxOPbtDcNOD*Bbr5FE_Jv>wk~ud!BC|?>TeM@BN)^jP+?~IRF?82BchFJ`0e@PJk9L
z)H<yxdE%tD^ky>v&;Z8z^f2fI^*_gqf2zy@p4e74)I51YTMKzw%20dJu(icNUsCD?
zv%aKwduzv^CNkafgQK2OdWHv17{2g+NXr0deU4^AC|D(U$uV9>BKVP?81>}zy%hb+
z{mQ?2fc`Xd`v_=X6MP^K7ytnDs_!zn`>doM_}F>7;G~J}u6Q-7ga6-_-Qe4{yIY6d
zJ+bbNo;b9lmz1BYOS*|6wpNCTFlX*i{!)R7Ik!(RriPh$XMH`onU{vAExe1P;OpfV
zW;+aaC-_7<tiPEXeKR>>jhFxm6SbXEv}Lvb@cJ$L9SZ*`tsThf@{;tkQ*f~0Q?oxf
zIWzpyuROyj&buLa5w2HkA)TDSQ>!}Xdh{<ojrrVsTq2)VDAx#W%+ZLtM5HJ!)%_!Z
zN=bD2ex`m3<Et51s<vu7F_lcWuK5bynY-=ovsVIlu_~gh_CG*=I#Wf9E(GKsxnN2L
z@7)Q*V)xRb2U5CDUVI<9uHUCWd!dU@yI6zC1Kt?4bguVBgzLV^7d42Ry?UJXF5)w?
zSp^ZOgcPg$bQYb$2bBC){zO$<W$@<U&na%?_aCx3lB$Zn#Q3}?wb}mu$KO%5t9eEp
zv6kyWX=zJSQkJv6DQxp9Dj$WM`u=*pJ8tpVmv5KH*!(U|iwXePX|^tJi+hy!!T;lZ
zxM3X}asKY$b)0u|xD-QR36|jq^UWA?L&Ovm(sEm00)~zI7!$io#k6eR2k(#(jUAs;
zRhcZ2V;0lp3vS^~6B&(-;(YKo^HgY1+O&aDwt=U8?b$tz@jkVZhV1GkBT6@lqF%u_
zcI(Lq<vGOz{C2FBHM;ppnyH(I=DBgkC(lQ-AUS#wbFyL7rM7;Vb4iLV?_cR~jRsV@
z>ZGK5+H6n-v6*c$LOCKht?Zlzh9C|G`g79p{21hUtQ!jL1QD*l%n&;)xQj4u{`l!W
zvq#D751h-o1eT8V=>^`GDSZQ<r*2nTpYnZX+h~|2>V2^&{KLXn8@-foaYA8{1APNS
zLC>4EkD~ntVCtheqjFU%;{xJ$pTT<pyR$0Bv7Hr4#>nt>vk^9~;t#eFg~42`sw;zZ
zJ^*`iglk?*R)h)qSZ4yGsSfV^m6(aX{Mv?5xh`I+gET{-Q$pt+YE#3EcB6BL;O2=E
z;zCr1@j(Y|y`8vs-BWq}3P_Gk7chMLG|YR9N^U4LVP#?Pg<FD7GM3Y8!hfQwt4l)s
zxz~`^Q{|$2v5NGbYvFp6Sr=%zoh|<SdhOjtGHvDJYUCNA#4o7(5s|lnC)&CKK06!-
z!<yQ&qL(6cnfcTGBHb>zu>bujT>V{MWW*P>VI4IElV#a6GQoNab4j5V7cGSoUphR$
zXn3Lb_a%QJf4{Fvv>bA~P72fs?THR=OnO+SARp7Fhk>Qn0hPMBy9N|^)l^W|PleUQ
z?VBjGH&UNLMy)MrIF~FhhO0HS`kVMhc5_doYICAZRZFfR?jDVaPkiW&`a{x<hXynE
z_;^f1-D3?)enyQ-&fi#0w&MtyPSl&7CXY9)_AceDi1;zjG90;6?#^v1@)7g6Ypnd{
z+MKyUdk<!x^@qh<U5B`^5;hDcOb4u~TJ);Kug{foaygri=_p!^9Yc3yC^XisRiPeg
zemG)(UV|VIEYFMnLs2K&cFC8H<yKj2j4!Rt)a9}C`or3I<Bc+H&Wi@a>o6}>gQrZB
zI+*A|mpAcPd=M*7Yoh1PnkGb`rf>(_muL0~=<Yjv_Di4czZY=OXH7pjpMIYfvO;D}
zxYbB?MdQKCmb#gMK9PIM0g0=+4_k+^v#5nV5UtZ%<ksWB+P?r+Tw>v+%w66eY3<;M
zLc5`HXsp{WYOv@p^`yYmz&X0%z7=Dnrctd7H(^mC`Q4d=n(<*rGwahL={rMY@0U7q
zmX-QQ;<>+84lsmJ3Aq106Zn4J=KZ^+7}0b7ocSqIcn(;-9WAwJM7C8ntkubP03*ZW
ztF52OE_rV!zcojbxIC<iFAEOqo$}W8;DM(e(+QDqk*C3k82Q*nRqYi|JXFvWs9?A0
zu=7#x&bOv2LbvSd_EWz{`hG2s7{c>eduP=gnB7NEo@A}_lfikzcN+~P!fbDOJ()5#
z+trrzK>l?Nk5nrm%D$#U9TW7q{;J+0|CFbh__ZsH^8U|8XmVVdIj!cK!^fYV$#`Lj
z&U3M6jqhlj>8)T26wogzX1H2)(bOhq-fz@is)tv?yN9oMjAh!KkP{@Pp5D!_?8}p4
zwOX`_sKFQNFlO-Fzky^IeUd5D2S2Zv#aFQ>^4565)jhGLugkMzGgF&o>}JeL0NAqz
zOh|t;0;X0C;ANQ!m@;MeN|oVu@UrM(p=a@lXt0jCkQHpoZu>8_425>VIeJ3(WgSak
z0h?#&vYOV&6F9RAlVOE7>Iy<kkLkFAhNtz!FnhO@d)nM$dg0XX%FSF|9G+e77nTKO
z%cqZ3VDPuY2iO9BtMI))emcKSC_4Icn#@r%?=r-x_Iyo`1AMtKu7m9Yj!&%4IZyW~
zIm>TEdZPK_UK9mhWZlc6jJCbS*4<OsvsR(C5hFW914Se&Z_pnFlC1%Jh%`?4Vf+CA
z=kuQDJh52P$swBJ7y>l1eT<Z(rtyX+>t&e2mc6cv2lBqY`*0E_<PmHaX5pY_mUe1$
zBxUmR(q2iixL1pd<7zsSH+-Ga_)O$#Bo?~WukSb<8nuuGpUWu=ck<w8*+ArG?ZP+V
zjjW3>LH4ofiI`U(bM0!CI`_*HQauUoX-#A5vK?N5VfeZrncCdYh3JtIM7Zc3_-yOI
z%1gMc*g|~jEFFLhV9pS;$m`(L2%6MwK%ZrJbo_41tYzSUL{9d+))l@}gealVAbt#Q
zd{UhJSr|)yWICcw?=w<q<c5@xtObp}ce4QcM0DYyzl`t2%9^^i`S-@X56QszzdS8c
znc^rtWyBPYg#czLlE*HCxK#bq{<a1*$~wVJiX6_>{THPHV%Ijv&{0yL569N9ga|TS
zn^ULzp#Iv8k&58|_mIF902ys!(sUcEQQvBFYjb0>I;qV!wW;yLN1^>|w!V5+GPakv
zIWGM@Gjk%X;%0*8RUpzqE#E%9<+6boLwid-t{a78avw}p*Rr8DGUAkOEOm8}TL@;&
z7cP%gW!uQ~m|LFUkd)0lHr4rtbL=hJ+IV%x;Hu*0*Mh>!5C+m(6Dv1Cx7)#oNHR(c
z*eC--VX?o!0UA@uaDa}JV{w?JP7oyBZEAn%V#_dikz?CUfh*L_H(-Jxx5k!4j>mAd
zbi5Dr8Mth&ufAh=+M0$nfZqQ0rvRVxG>`699=?k(CF~!WxFpQu8?R%zgw(q#Zzd`p
zaysFzfKKux(m`bYv%`X?OTRW3LTcri_{}LiySt6ZY@L7sjmWj-TxQ+@|1{Nz;2vz`
zf$E0M>d24u5Ey=(JFOG`FBoL01l=+eoxPpsH$b*H6c9u{<U_sY2S6Yd9M&F90wkp#
z)N6jOM}}xj8_2F*p%A-lE?}A22>vDX>%b1BP1>vZ#UJ~*guJEGQa4bg`ODAaqz4bF
zNKA$dh*9O;&X^XQti-q(oi*1|k>HrH5@ajOvoNf<A>>!%Z<4=E;JvEC@0a~&6Vk5z
z_@bUme*<b%dZnHLKK^Cc<7|LhMO{et1MT8mD$RrK_30;GC#_!Sl*ZX~RST=@J#%-6
zFn`VpA$w!qLmiqlhrs9Olcvzm!X=B8B9An`<<T>$Q(zwbl|qt7GrpEhjkb>mouNF6
zM*dNd=DfyR(VtLiD8dy+O(oofXB5tN)M%Wb8+WwN+VjeVd$3;q()B9ZjEn;|v59cY
z#OgtsJl(?KSe?okJZt4aMKF(aTstRNdfuXu#ylTf{WoL2-oZTlHgx11S&N6b)A21r
zDrydZd|my%i$d!vxoj_V(DG`mPp(S3L_*6dQ4WKz+o~k1D`bHI*y15&`-7HEqEv&g
z+ZMjBp2V+*iU8>v1Z6c*romSVW%5;&G!n=Z>9PUsO+>i}VnbnyY>T3_L^|I=C6_36
zVDqQ2L|j!!fuSsLP=XRgdB+cC$VNkQj7TRBC}D}>{!2Tgq$Uj!x-`<>PadKq_!|O6
zh{OqoG{k=!6o{^U1<h<%7SeBr1_#o{2vs|xi0&j&qYU6X>nOp6Iw(<WL27P)^Hx74
z$CI=rk;fiIsrp|%fch6v92hA)*y?8FUXb<za^@%eoBDtCgd9!}rhoBdtCbLwn6fF5
zb2a;CCjMzH#Hb)Uq;;5_t8ag4hcdkH)eX98(#i)_aH6z;H&1re-#aC_IXW;+z+YOx
NKS??OC}4p;{SUo+@zVeR

literal 0
HcmV?d00001


From 0216501f424cbb9a2c6a35f1bc52fb1e4b5877ae Mon Sep 17 00:00:00 2001
From: Joerg Hoh <jhoh@adobe.com>
Date: Fri, 25 Jul 2025 19:17:21 +0200
Subject: [PATCH 03/10] add failing test

---
 .../vault/packaging/integration/ImportIT.java | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java b/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java
index 9dc139c95..6ca89fe84 100644
--- a/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java
+++ b/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java
@@ -472,4 +472,28 @@ public void testSkipFilterChecksOnImport_enabled() throws Exception {
         assertNodeExists("/tmp/foo");
         assertPropertyExists("/tmp/foo/bar/tobi/excludedProp");
     }
+
+    @Test
+    public void testSkipFilterChecksOnImport_enabled_mergeWithExisting() throws Exception {
+        ImportOptions opts = getDefaultOptions();
+        opts.setSkipFilterChecksOnImport(true);
+        Node tmp= admin.getRootNode().addNode("tmp");
+        Node tobi = tmp.addNode("foo").addNode("bar").addNode("tobi");
+        tobi.setProperty("excludedProp", "existingvalue");
+        tobi.setProperty("excludedProp-foo", "should-survive");
+        admin.save();
+        Importer importer = new Importer(opts);
+        try (Archive archive = getFileArchive("/test-packages/tmp-content-outside-filters.zip")) {
+            archive.open(true);
+            importer.run(archive, admin.getRootNode());
+            admin.save();
+        }
+        assertNodeExists("/tmp/foo");
+        assertPropertyExists("/tmp/foo/bar/tobi/excludedProp");
+        // import has overwritten existing property
+        assertProperty("/tmp/foo/bar/tobi/excludedProp", "excluded property");
+        // but an existing property which is not overwritten by content in the package remains available
+        assertProperty("/tmp/foo/bar/tobi/excludedProp-foo", "should-survive");
+    }
+    
 }
\ No newline at end of file

From f032f825f8d5096da925e8a86af88ad61fe61f94 Mon Sep 17 00:00:00 2001
From: Joerg Hoh <jhoh@adobe.com>
Date: Tue, 29 Jul 2025 14:34:40 +0200
Subject: [PATCH 04/10] JCRVLT-810 move the check to the DocViewImporter

---
 .../vault/fs/config/DefaultWorkspaceFilter.java   |  9 ++++-----
 .../vault/fs/impl/io/DocViewImporter.java         | 15 +++++++++++++--
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
index 2fd317c0a..5e76a7a20 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
@@ -241,6 +241,10 @@ public void setSkipFilterChecksOnImport(boolean skipFilterChecksOnImport) {
         this.skipFilterChecksOnImport = skipFilterChecksOnImport;
     }
 
+    public boolean getSkipFilterChecksOnImport() {
+        return this.skipFilterChecksOnImport;
+    }
+
     /**
      * {@inheritDoc}
      */
@@ -273,11 +277,6 @@ public boolean covers(String path) {
 
     @Override
     public boolean includesProperty(String propertyPath) {
-        if (skipFilterChecksOnImport) {
-            // skip the filter checks if requested; assume that the package only includes content
-            // which matches the filters.
-            return true;
-        }
         if (!covers(propertyPath)) {
             // include all properties that are not covered by any filter. this is to ensure that the ancestor paths
             // have at least jcr:primary type.
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java
index 9e63fc29b..700a6a78f 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java
@@ -72,6 +72,7 @@
 import org.apache.jackrabbit.vault.fs.api.IdConflictPolicy;
 import org.apache.jackrabbit.vault.fs.api.ImportInfo.Info;
 import org.apache.jackrabbit.vault.fs.api.ImportInfo.Type;
+import org.apache.jackrabbit.vault.fs.config.DefaultWorkspaceFilter;
 import org.apache.jackrabbit.vault.fs.api.ImportMode;
 import org.apache.jackrabbit.vault.fs.api.ItemFilterSet;
 import org.apache.jackrabbit.vault.fs.api.NodeNameList;
@@ -225,6 +226,11 @@ public class DocViewImporter implements DocViewParserHandler {
      */
     private final boolean isSnsSupported;
 
+    /**
+     * set true if filter checks can be skipped on import
+     */
+    private boolean skipFilterChecksOnImport = false;
+
     /**
      * Creates a new importer that will imports the
      * items below the given root.
@@ -270,9 +276,13 @@ public DocViewImporter(Node parentNode, String rootNodeName,
         for (Artifact a : artifacts.values(ArtifactType.HINT)) {
             hints.add(rootPath + a.getRelativePath());
         }
-        
+
         stack = new StackElement(parentNode, parentNode.isNew());
         npResolver = new DefaultNamePathResolver(parentNode.getSession());
+
+        if (wspFilter instanceof DefaultWorkspaceFilter) {
+            skipFilterChecksOnImport = ((DefaultWorkspaceFilter) wspFilter).getSkipFilterChecksOnImport();
+        }
     }
 
     /**
@@ -1277,7 +1287,8 @@ private boolean setUnprotectedProperties(@NotNull EffectiveNodeType effectiveNod
         // add properties
         for (DocViewProperty2 prop : ni.getProperties()) {
             String name = npResolver.getJCRName(prop.getName());
-            if (prop != null && !isPropertyProtected(effectiveNodeType, prop) && (overwriteExistingProperties || !node.hasProperty(name)) && wspFilter.includesProperty(node.getPath() + "/" + name)) {
+            final boolean allowedByFilter = (skipFilterChecksOnImport | wspFilter.includesProperty(node.getPath() + "/" + name));
+            if (prop != null && !isPropertyProtected(effectiveNodeType, prop) && (overwriteExistingProperties || !node.hasProperty(name)) && allowedByFilter) {
                 // check if property is allowed
                 try {
                     modified |= prop.apply(node);

From d8faa692d4221a28feb23a53669f5268697235de Mon Sep 17 00:00:00 2001
From: Joerg Hoh <jhoh@adobe.com>
Date: Sun, 3 Aug 2025 12:32:37 +0200
Subject: [PATCH 05/10] improve javadoc

---
 vault-core/.DS_Store                             | Bin 0 -> 8196 bytes
 .../jackrabbit/vault/fs/io/ImportOptions.java    |   6 ++++--
 2 files changed, 4 insertions(+), 2 deletions(-)
 create mode 100644 vault-core/.DS_Store

diff --git a/vault-core/.DS_Store b/vault-core/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..1acb219d71f95a4e58d1c2754c98c0e465a67382
GIT binary patch
literal 8196
zcmeHMU2GIp6h3EK=)IPo3lwM>Ru>BdXob@9|GRA$N)f2AE&TyqW_JddFr6tov%4t4
z)I_63BpUV6|HKDlh(4J3%M%Zxi4V{ajXoG3d@|w12Y=$vxpQZM7I+{g{)D;7+;i`_
z=eslK%y(w?%mM&*6wQ?Y^#H)=kW$oAcatX9<#9vPB26_(Bs_oxL9XnN<Qy+|gLSNk
zBM?U*jzAoNI0A75{tFSHceZTo7Vmwv8uxJo;t1T45s=S^Bpp(wA~~vL_~@W6ECEQ$
z5+H0eraB<RBqN!M<fxJ%l=f8B14dAcN(@wRT2D%IlBr0JDyiUr3Jw^Z8KVjX!?P1E
z8JYv8l#Kg00&xUxjDSp^$q;}61voOHe*Z8x;@E!B(sCKKs_IFTYgi4dWe;YKdgV-D
z1Vz8YC>)TpUe9xKm9dfAZ(HT8sO$9Hz_4Ab5CUw|B9nvtwrhIj4zK8%eu&Me1;!cA
ziiVRXTU*zyX-=+M*><Wqd2)Sg3ys^>oI1tX?8X%v_hpYc!>;#?@&lu10Zg6X*XfB)
zIew{AeUzx0S8?jAic_4|>iq+QLs=n;zO~PCjKD5gX(O=wteEbTf8BY{eV|~K$glpq
z=M;xsTA7hIoP3dtt#-%B*pFELKwzB+<Y>tE3PERRIA9Z2>at>{#P^H@w&(i$t%6UI
z^RrWCC+=O`)UtZR)^zvoy<=0SO&6Tcs_QS=zMXTdLBr2mu4%hR`pUK$937%?xq*Gy
zwhEljz;v%`3|nJj&fNNjdAhD_u3;*>3>0(r@uD3(EE*Y8=g^Z2I1}$5G|7S8o+)=U
z!xddmE@JF})OQvv>Xn-7OP3MA==I5&=rWhD;9U5<$LO9aC~sTExG?)1BWF30YTbHL
z-QQnQ9!JW}TNqt^^FZDk9wvW$rPez-858FplIPxK_(9Kz<zBt2t{t@Y*^qzKC|EsZ
zqE&?H+QnFSpGYr3+e|y~3Smh0Bz1jIZq{y^mPwx1&zURqjNZq@MZyT%E!jk5x)F-c
ztTDArQ7H^-W2!~X>L&0@zN{Lc8MeT77=k>wP=?d+ES!Ot;Vn1|AHX@d0H4Db@FiS=
zZ{d6R5q^T-;ZFoaybEh_3Qj{E7vdsZjIFp4H{oX7ifP=9d$0%h;(pBHAv7?LHWtvw
z0898NK8a7^(|8(R!dLKBd=1~g_wXb97(c;tcmXfsB^<*a@CyEdzv6FNwKhqs(U_)d
z^R-3VGObN{p;fZxz<95;G|k673Mgx$PkGw$n`KR6d)JQce<f?ao+9&P#>`oDv+r(P
za$oD3jj5|tQsk@f?Rp-E)E!6okh<Z$p2)c{q4@knA933{aV?`%hE?)P)JPVyF=>4d
zUyu-!i2Z81kS|V%$;5m$U7Bc02#pd>O_wKHxTvCZ;vu#z(ZmHZHCfBob5Tu+rKX$s
z7A`>Mx|+8qIuk;s3H$qWeI4G0cZsg&iLRI78~6^cz|ZgpGNR`ktj7kNj|rma5?qQ+
z*o>=jEv~~2MA$TL$1d!~otVKsqU!(-Vh&BT@GyFKoJbpBktjQgkKyC^1fId?@OgXz
zUku6nCcZO)j627Z5kH+s#!{x>I-Yxk^c4b+hs3knjX;$G)XVyR+pWL<-|n`teH?)}
z0{^23V0Ai^?w||4)q_>m+DSSN(IK0(8&xudP#2ctB*Su?<kde6X`CceiAhCrR7uiM
W`^P^7T>pbNe*ees|B!`uUiTN=CLDqQ

literal 0
HcmV?d00001

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
index 9ef65dd95..995f1989c 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
@@ -485,9 +485,11 @@ public void setIdConflictPolicy(@NotNull IdConflictPolicy idConflictPolicy) {
     }
 
     /**
-     * Allows to skip filter checks when importing content; you can set this
+     * Allows to skip filter checks when importing packages; you can set this
      * to {{code true}} if you are sure that there this package contains no content
-     * which would be rejected by filters
+     * which would be rejected by filters.
+     * This only affects checks against items in the package, but not existing items in
+     * the repository.
      * @param skipFilterChecksOnImport if true skip the checks
      */
     public void setSkipFilterChecksOnImport (boolean skipFilterChecksOnImport) {

From 71d7eb6a590c3435b7d501d525afc59211a64074 Mon Sep 17 00:00:00 2001
From: Joerg Hoh <jhoh@adobe.com>
Date: Sun, 3 Aug 2025 16:09:01 +0200
Subject: [PATCH 06/10] skip checks on more occassions of importing a package

---
 .../jackrabbit/vault/fs/impl/io/DocViewImporter.java      | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java
index 700a6a78f..dda27b9d2 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java
@@ -1024,7 +1024,8 @@ private void removeReferences(@NotNull Node node) throws ReferentialIntegrityExc
             // TODO: is this faster than using sysview import?
             // set new primary type (but never set rep:root)
             String newPrimaryType = ni.getPrimaryType().orElseThrow(() -> new IllegalStateException("Mandatory property 'jcr:primaryType' missing from " + ni));
-            if (importMode == ImportMode.REPLACE && !"rep:root".equals(newPrimaryType) && wspFilter.includesProperty(PathUtil.append(node.getPath(), JcrConstants.JCR_PRIMARYTYPE))) {
+            final boolean allowedByFilter = (skipFilterChecksOnImport || wspFilter.includesProperty(PathUtil.append(node.getPath(), JcrConstants.JCR_PRIMARYTYPE)));
+            if (importMode == ImportMode.REPLACE && !"rep:root".equals(newPrimaryType) && allowedByFilter) {
                 String currentPrimaryType = node.getPrimaryNodeType().getName();
                 if (!currentPrimaryType.equals(newPrimaryType)) {
                     vs.ensureCheckedOut();
@@ -1167,7 +1168,8 @@ private void removeReferences(@NotNull Node node) throws ReferentialIntegrityExc
             // add the protected properties
             for (DocViewProperty2 p : ni.getProperties()) {
                 String qualifiedPropertyName = npResolver.getJCRName(p.getName());
-                if (p.getStringValue().isPresent() && PROTECTED_PROPERTIES_CONSIDERED_FOR_NEW_NODES.contains(p.getName()) && wspFilter.includesProperty(nodePath + "/" + qualifiedPropertyName)) {
+                final boolean allowedByFilter = (skipFilterChecksOnImport || wspFilter.includesProperty(nodePath + "/" + qualifiedPropertyName));
+                if (p.getStringValue().isPresent() && PROTECTED_PROPERTIES_CONSIDERED_FOR_NEW_NODES.contains(p.getName()) && allowedByFilter) {
                     attrs = new AttributesImpl();
                     attrs.addAttribute(Name.NS_SV_URI, "name", "sv:name", ATTRIBUTE_TYPE_CDATA, qualifiedPropertyName);
                     attrs.addAttribute(Name.NS_SV_URI, "type", "sv:type", ATTRIBUTE_TYPE_CDATA, PropertyType.nameFromValue(p.getType()));
@@ -1287,7 +1289,7 @@ private boolean setUnprotectedProperties(@NotNull EffectiveNodeType effectiveNod
         // add properties
         for (DocViewProperty2 prop : ni.getProperties()) {
             String name = npResolver.getJCRName(prop.getName());
-            final boolean allowedByFilter = (skipFilterChecksOnImport | wspFilter.includesProperty(node.getPath() + "/" + name));
+            final boolean allowedByFilter = (skipFilterChecksOnImport || wspFilter.includesProperty(node.getPath() + "/" + name));
             if (prop != null && !isPropertyProtected(effectiveNodeType, prop) && (overwriteExistingProperties || !node.hasProperty(name)) && allowedByFilter) {
                 // check if property is allowed
                 try {

From e7124246b5b83d7ae6ecfb896539f2a18a490085 Mon Sep 17 00:00:00 2001
From: Joerg Hoh <jhoh@adobe.com>
Date: Sun, 7 Sep 2025 15:35:46 +0200
Subject: [PATCH 07/10] JCRVLT-810 use a non-binary package for test-content

---
 .../vault/packaging/integration/ImportIT.java |   6 +-
 .../outside-filters.zip/META-INF/MANIFEST.MF  |   3 +
 .../META-INF/vault/config.xml                 |  77 ++++++++++++++++++
 .../META-INF/vault/definition/.content.xml    |  25 ++++++
 .../META-INF/vault/filter.xml                 |   6 ++
 .../META-INF/vault/nodetypes.cnd              |  12 +++
 .../META-INF/vault/properties.xml             |  19 +++++
 .../outside-filters.zip/jcr_root/.content.xml |  16 ++++
 .../jcr_root/tmp/.content.xml                 |   5 ++
 .../jcr_root/tmp/foo/.content.xml             |   5 ++
 .../jcr_root/tmp/foo/bar/.content.xml         |   5 ++
 .../jcr_root/tmp/foo/bar/tobi/.content.xml    |   5 ++
 .../tmp-content-outside-filters.zip           | Bin 5104 -> 0 bytes
 13 files changed, 181 insertions(+), 3 deletions(-)
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/MANIFEST.MF
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/config.xml
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/definition/.content.xml
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/filter.xml
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/nodetypes.cnd
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/properties.xml
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/.content.xml
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/.content.xml
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/.content.xml
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/bar/.content.xml
 create mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/bar/tobi/.content.xml
 delete mode 100644 vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/tmp-content-outside-filters.zip

diff --git a/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java b/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java
index 6ca89fe84..981439602 100644
--- a/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java
+++ b/vault-core-it/vault-core-integration-tests/src/main/java/org/apache/jackrabbit/vault/packaging/integration/ImportIT.java
@@ -450,7 +450,7 @@ public void testEnhancedFileAggregatePackageWithIntermediateSaves() throws IOExc
     public void testSkipFilterChecksOnImport_disabled() throws Exception {
         ImportOptions opts = getDefaultOptions();
         Importer importer = new Importer(opts);
-        try (Archive archive = getFileArchive("/test-packages/tmp-content-outside-filters.zip")) {
+        try (Archive archive = getFileArchive("/test-packages/outside-filters.zip")) {
             archive.open(true);
             importer.run(archive, admin.getRootNode());
             admin.save();
@@ -464,7 +464,7 @@ public void testSkipFilterChecksOnImport_enabled() throws Exception {
         ImportOptions opts = getDefaultOptions();
         opts.setSkipFilterChecksOnImport(true);
         Importer importer = new Importer(opts);
-        try (Archive archive = getFileArchive("/test-packages/tmp-content-outside-filters.zip")) {
+        try (Archive archive = getFileArchive("/test-packages/outside-filters.zip")) {
             archive.open(true);
             importer.run(archive, admin.getRootNode());
             admin.save();
@@ -483,7 +483,7 @@ public void testSkipFilterChecksOnImport_enabled_mergeWithExisting() throws Exce
         tobi.setProperty("excludedProp-foo", "should-survive");
         admin.save();
         Importer importer = new Importer(opts);
-        try (Archive archive = getFileArchive("/test-packages/tmp-content-outside-filters.zip")) {
+        try (Archive archive = getFileArchive("/test-packages/outside-filters.zip")) {
             archive.open(true);
             importer.run(archive, admin.getRootNode());
             admin.save();
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/MANIFEST.MF b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/MANIFEST.MF
new file mode 100644
index 000000000..3ac18c147
--- /dev/null
+++ b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/MANIFEST.MF
@@ -0,0 +1,3 @@
+Manifest-Version: 1.0
+Created-By: 11.0.21 (Eclipse Adoptium)
+
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/config.xml b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/config.xml
new file mode 100644
index 000000000..941af6c2e
--- /dev/null
+++ b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/config.xml
@@ -0,0 +1,77 @@
+<vaultfs version="1.1">
+    <!--
+        Defines the content aggregation. The order of the defined aggregates
+        is important for finding the correct aggregator.
+    -->
+    <aggregates>
+        <!--
+            Defines an aggregate that handles nt:file and nt:resource nodes.
+        -->
+        <aggregate type="file" title="File Aggregate"/>
+
+        <!--
+            Defines an aggregate that handles file/folder like nodes. It matches
+            all nt:hierarchyNode nodes that have or define a jcr:content
+            child node and excludes child nodes that are nt:hierarchyNodes.
+        -->
+        <aggregate type="filefolder" title="File/Folder Aggregate"/>
+
+        <!--
+            Defines an aggregate that handles nt:nodeType nodes and serializes
+            them into .cnd notation.
+        -->
+        <aggregate type="nodetype" title="Node Type Aggregate" />
+
+        <!--
+            Defines an aggregate that defines full coverage for certain node
+            types that cannot be covered by the default aggregator.
+        -->
+        <aggregate type="full" title="Full Coverage Aggregate">
+            <matches>
+                <include nodeType="rep:AccessControl" respectSupertype="true" />
+                <include nodeType="rep:Policy" respectSupertype="true" />
+                <include nodeType="cq:Widget" respectSupertype="true" />
+                <include nodeType="cq:EditConfig" respectSupertype="true" />
+                <include nodeType="cq:WorkflowModel" respectSupertype="true" />
+                <include nodeType="vlt:FullCoverage" respectSupertype="true" />
+                <include nodeType="mix:language" respectSupertype="true" />
+                <include nodeType="sling:OsgiConfig" respectSupertype="true" />
+            </matches>
+        </aggregate>
+
+        <!--
+            Defines an aggregate that handles nt:folder like nodes.
+        -->
+        <aggregate type="generic" title="Folder Aggregate">
+            <matches>
+                <include nodeType="nt:folder" respectSupertype="true" />
+            </matches>
+            <contains>
+                <exclude isNode="true" />
+            </contains>
+        </aggregate>
+
+        <!--
+            Defines the default aggregate
+        -->
+        <aggregate type="generic" title="Default Aggregator" isDefault="true">
+            <matches>
+                <!-- all -->
+            </matches>
+            <contains>
+                <exclude nodeType="nt:hierarchyNode" respectSupertype="true" />
+            </contains>
+        </aggregate>
+
+    </aggregates>
+
+    <!--
+      defines the input handlers
+    -->
+    <handlers>
+        <handler type="folder"/>
+        <handler type="file"/>
+        <handler type="nodetype"/>
+        <handler type="generic"/>
+    </handlers>
+</vaultfs>
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/definition/.content.xml b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/definition/.content.xml
new file mode 100644
index 000000000..d27295b90
--- /dev/null
+++ b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/definition/.content.xml
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jcr:root xmlns:vlt="http://www.day.com/jcr/vault/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:nt="http://www.jcp.org/jcr/nt/1.0"
+    jcr:created="{Date}2011-06-07T14:31:49.179-07:00"
+    jcr:createdBy="admin"
+    jcr:description=""
+    jcr:lastModified="{Date}2011-06-07T14:31:49.179-07:00"
+    jcr:lastModifiedBy="admin"
+    jcr:primaryType="vlt:PackageDefinition"
+    buildCount="1"
+    cqVersion="5.3"
+    group="my_packages"
+    lastUnwrapped="{Date}2011-06-07T14:31:49.179-07:00"
+    lastUnwrappedBy="admin"
+    lastWrapped="{Date}2011-06-07T14:31:49.179-07:00"
+    lastWrappedBy="admin"
+    name="tmp"
+    version="">
+    <filter jcr:primaryType="nt:unstructured">
+        <f0
+            jcr:primaryType="nt:unstructured"
+            mode="replace"
+            root="/tmp"
+            rules="[]"/>
+    </filter>
+</jcr:root>
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/filter.xml b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/filter.xml
new file mode 100644
index 000000000..9c34b21a5
--- /dev/null
+++ b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/filter.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<workspaceFilter version="1.0">
+    <filter root="/tmp">
+      <exclude pattern="^.*/excludedProp.*" matchProperties="true"/>
+    </filter>
+</workspaceFilter>
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/nodetypes.cnd b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/nodetypes.cnd
new file mode 100644
index 000000000..56fe4200b
--- /dev/null
+++ b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/nodetypes.cnd
@@ -0,0 +1,12 @@
+<'sling'='http://sling.apache.org/jcr/sling/1.0'>
+<'nt'='http://www.jcp.org/jcr/nt/1.0'>
+
+[sling:Folder] > nt:folder
+  - * (undefined)
+  - * (undefined) multiple
+  + * (nt:base) = sling:Folder version
+
+[sling:OrderedFolder] > sling:Folder
+  orderable
+  + * (nt:base) = sling:OrderedFolder version
+
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/properties.xml b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/properties.xml
new file mode 100644
index 000000000..2f63d5c00
--- /dev/null
+++ b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/META-INF/vault/properties.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8" standalone="no"?>
+<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
+<properties>
+<comment>FileVault Package Properties</comment>
+<entry key="createdBy">admin</entry>
+<entry key="name">tmp</entry>
+<entry key="lastModified">2011-06-07T14:31:49.179-07:00</entry>
+<entry key="lastModifiedBy">admin</entry>
+<entry key="created">2011-06-07T14:31:49.418-07:00</entry>
+<entry key="buildCount">1</entry>
+<entry key="version"/>
+<entry key="dependencies"/>
+<entry key="packageFormatVersion">2</entry>
+<entry key="description"/>
+<entry key="group">my_packages</entry>
+<entry key="lastWrapped">2011-06-07T14:31:49.179-07:00</entry>
+<entry key="lastWrappedBy">admin</entry>
+<entry key="path">/etc/packages/my_packages/tmp</entry>
+</properties>
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/.content.xml b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/.content.xml
new file mode 100644
index 000000000..c269eee38
--- /dev/null
+++ b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/.content.xml
@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0" xmlns:rep="internal"
+    jcr:mixinTypes="[rep:AccessControllable]"
+    jcr:primaryType="rep:root"
+    sling:resourceType="sling:redirect"
+    sling:target="/welcome.html">
+    <home/>
+    <rep:policy/>
+    <jcr:system/>
+    <etc/>
+    <apps/>
+    <libs/>
+    <content/>
+    <var/>
+    <tmp/>
+</jcr:root>
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/.content.xml b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/.content.xml
new file mode 100644
index 000000000..7948b7098
--- /dev/null
+++ b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/.content.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"
+    jcr:primaryType="sling:OrderedFolder">
+    <foo/>
+</jcr:root>
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/.content.xml b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/.content.xml
new file mode 100644
index 000000000..f0bb4c26f
--- /dev/null
+++ b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/.content.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"
+    jcr:primaryType="sling:OrderedFolder">
+    <bar/>
+</jcr:root>
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/bar/.content.xml b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/bar/.content.xml
new file mode 100644
index 000000000..4107c35a0
--- /dev/null
+++ b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/bar/.content.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"
+    jcr:primaryType="sling:OrderedFolder">
+    <tobi/>
+</jcr:root>
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/bar/tobi/.content.xml b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/bar/tobi/.content.xml
new file mode 100644
index 000000000..cd1ec9f57
--- /dev/null
+++ b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/outside-filters.zip/jcr_root/tmp/foo/bar/tobi/.content.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jcr:root xmlns:sling="http://sling.apache.org/jcr/sling/1.0" xmlns:jcr="http://www.jcp.org/jcr/1.0"
+    jcr:primaryType="sling:OrderedFolder"
+    excludedProp="excluded property"
+    />
diff --git a/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/tmp-content-outside-filters.zip b/vault-core-it/vault-core-integration-tests/src/main/resources/test-packages/tmp-content-outside-filters.zip
deleted file mode 100644
index c852c60e18f9fd019704dfbc18c5577373915048..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5104
zcma)A2{@GN7yoRTtQp3haHEiYiHKB|ERo4lmJp*c7|YlzWeHg#%O%kbMOiA>GL}h}
zxOPbtDcNOD*Bbr5FE_Jv>wk~ud!BC|?>TeM@BN)^jP+?~IRF?82BchFJ`0e@PJk9L
z)H<yxdE%tD^ky>v&;Z8z^f2fI^*_gqf2zy@p4e74)I51YTMKzw%20dJu(icNUsCD?
zv%aKwduzv^CNkafgQK2OdWHv17{2g+NXr0deU4^AC|D(U$uV9>BKVP?81>}zy%hb+
z{mQ?2fc`Xd`v_=X6MP^K7ytnDs_!zn`>doM_}F>7;G~J}u6Q-7ga6-_-Qe4{yIY6d
zJ+bbNo;b9lmz1BYOS*|6wpNCTFlX*i{!)R7Ik!(RriPh$XMH`onU{vAExe1P;OpfV
zW;+aaC-_7<tiPEXeKR>>jhFxm6SbXEv}Lvb@cJ$L9SZ*`tsThf@{;tkQ*f~0Q?oxf
zIWzpyuROyj&buLa5w2HkA)TDSQ>!}Xdh{<ojrrVsTq2)VDAx#W%+ZLtM5HJ!)%_!Z
zN=bD2ex`m3<Et51s<vu7F_lcWuK5bynY-=ovsVIlu_~gh_CG*=I#Wf9E(GKsxnN2L
z@7)Q*V)xRb2U5CDUVI<9uHUCWd!dU@yI6zC1Kt?4bguVBgzLV^7d42Ry?UJXF5)w?
zSp^ZOgcPg$bQYb$2bBC){zO$<W$@<U&na%?_aCx3lB$Zn#Q3}?wb}mu$KO%5t9eEp
zv6kyWX=zJSQkJv6DQxp9Dj$WM`u=*pJ8tpVmv5KH*!(U|iwXePX|^tJi+hy!!T;lZ
zxM3X}asKY$b)0u|xD-QR36|jq^UWA?L&Ovm(sEm00)~zI7!$io#k6eR2k(#(jUAs;
zRhcZ2V;0lp3vS^~6B&(-;(YKo^HgY1+O&aDwt=U8?b$tz@jkVZhV1GkBT6@lqF%u_
zcI(Lq<vGOz{C2FBHM;ppnyH(I=DBgkC(lQ-AUS#wbFyL7rM7;Vb4iLV?_cR~jRsV@
z>ZGK5+H6n-v6*c$LOCKht?Zlzh9C|G`g79p{21hUtQ!jL1QD*l%n&;)xQj4u{`l!W
zvq#D751h-o1eT8V=>^`GDSZQ<r*2nTpYnZX+h~|2>V2^&{KLXn8@-foaYA8{1APNS
zLC>4EkD~ntVCtheqjFU%;{xJ$pTT<pyR$0Bv7Hr4#>nt>vk^9~;t#eFg~42`sw;zZ
zJ^*`iglk?*R)h)qSZ4yGsSfV^m6(aX{Mv?5xh`I+gET{-Q$pt+YE#3EcB6BL;O2=E
z;zCr1@j(Y|y`8vs-BWq}3P_Gk7chMLG|YR9N^U4LVP#?Pg<FD7GM3Y8!hfQwt4l)s
zxz~`^Q{|$2v5NGbYvFp6Sr=%zoh|<SdhOjtGHvDJYUCNA#4o7(5s|lnC)&CKK06!-
z!<yQ&qL(6cnfcTGBHb>zu>bujT>V{MWW*P>VI4IElV#a6GQoNab4j5V7cGSoUphR$
zXn3Lb_a%QJf4{Fvv>bA~P72fs?THR=OnO+SARp7Fhk>Qn0hPMBy9N|^)l^W|PleUQ
z?VBjGH&UNLMy)MrIF~FhhO0HS`kVMhc5_doYICAZRZFfR?jDVaPkiW&`a{x<hXynE
z_;^f1-D3?)enyQ-&fi#0w&MtyPSl&7CXY9)_AceDi1;zjG90;6?#^v1@)7g6Ypnd{
z+MKyUdk<!x^@qh<U5B`^5;hDcOb4u~TJ);Kug{foaygri=_p!^9Yc3yC^XisRiPeg
zemG)(UV|VIEYFMnLs2K&cFC8H<yKj2j4!Rt)a9}C`or3I<Bc+H&Wi@a>o6}>gQrZB
zI+*A|mpAcPd=M*7Yoh1PnkGb`rf>(_muL0~=<Yjv_Di4czZY=OXH7pjpMIYfvO;D}
zxYbB?MdQKCmb#gMK9PIM0g0=+4_k+^v#5nV5UtZ%<ksWB+P?r+Tw>v+%w66eY3<;M
zLc5`HXsp{WYOv@p^`yYmz&X0%z7=Dnrctd7H(^mC`Q4d=n(<*rGwahL={rMY@0U7q
zmX-QQ;<>+84lsmJ3Aq106Zn4J=KZ^+7}0b7ocSqIcn(;-9WAwJM7C8ntkubP03*ZW
ztF52OE_rV!zcojbxIC<iFAEOqo$}W8;DM(e(+QDqk*C3k82Q*nRqYi|JXFvWs9?A0
zu=7#x&bOv2LbvSd_EWz{`hG2s7{c>eduP=gnB7NEo@A}_lfikzcN+~P!fbDOJ()5#
z+trrzK>l?Nk5nrm%D$#U9TW7q{;J+0|CFbh__ZsH^8U|8XmVVdIj!cK!^fYV$#`Lj
z&U3M6jqhlj>8)T26wogzX1H2)(bOhq-fz@is)tv?yN9oMjAh!KkP{@Pp5D!_?8}p4
zwOX`_sKFQNFlO-Fzky^IeUd5D2S2Zv#aFQ>^4565)jhGLugkMzGgF&o>}JeL0NAqz
zOh|t;0;X0C;ANQ!m@;MeN|oVu@UrM(p=a@lXt0jCkQHpoZu>8_425>VIeJ3(WgSak
z0h?#&vYOV&6F9RAlVOE7>Iy<kkLkFAhNtz!FnhO@d)nM$dg0XX%FSF|9G+e77nTKO
z%cqZ3VDPuY2iO9BtMI))emcKSC_4Icn#@r%?=r-x_Iyo`1AMtKu7m9Yj!&%4IZyW~
zIm>TEdZPK_UK9mhWZlc6jJCbS*4<OsvsR(C5hFW914Se&Z_pnFlC1%Jh%`?4Vf+CA
z=kuQDJh52P$swBJ7y>l1eT<Z(rtyX+>t&e2mc6cv2lBqY`*0E_<PmHaX5pY_mUe1$
zBxUmR(q2iixL1pd<7zsSH+-Ga_)O$#Bo?~WukSb<8nuuGpUWu=ck<w8*+ArG?ZP+V
zjjW3>LH4ofiI`U(bM0!CI`_*HQauUoX-#A5vK?N5VfeZrncCdYh3JtIM7Zc3_-yOI
z%1gMc*g|~jEFFLhV9pS;$m`(L2%6MwK%ZrJbo_41tYzSUL{9d+))l@}gealVAbt#Q
zd{UhJSr|)yWICcw?=w<q<c5@xtObp}ce4QcM0DYyzl`t2%9^^i`S-@X56QszzdS8c
znc^rtWyBPYg#czLlE*HCxK#bq{<a1*$~wVJiX6_>{THPHV%Ijv&{0yL569N9ga|TS
zn^ULzp#Iv8k&58|_mIF902ys!(sUcEQQvBFYjb0>I;qV!wW;yLN1^>|w!V5+GPakv
zIWGM@Gjk%X;%0*8RUpzqE#E%9<+6boLwid-t{a78avw}p*Rr8DGUAkOEOm8}TL@;&
z7cP%gW!uQ~m|LFUkd)0lHr4rtbL=hJ+IV%x;Hu*0*Mh>!5C+m(6Dv1Cx7)#oNHR(c
z*eC--VX?o!0UA@uaDa}JV{w?JP7oyBZEAn%V#_dikz?CUfh*L_H(-Jxx5k!4j>mAd
zbi5Dr8Mth&ufAh=+M0$nfZqQ0rvRVxG>`699=?k(CF~!WxFpQu8?R%zgw(q#Zzd`p
zaysFzfKKux(m`bYv%`X?OTRW3LTcri_{}LiySt6ZY@L7sjmWj-TxQ+@|1{Nz;2vz`
zf$E0M>d24u5Ey=(JFOG`FBoL01l=+eoxPpsH$b*H6c9u{<U_sY2S6Yd9M&F90wkp#
z)N6jOM}}xj8_2F*p%A-lE?}A22>vDX>%b1BP1>vZ#UJ~*guJEGQa4bg`ODAaqz4bF
zNKA$dh*9O;&X^XQti-q(oi*1|k>HrH5@ajOvoNf<A>>!%Z<4=E;JvEC@0a~&6Vk5z
z_@bUme*<b%dZnHLKK^Cc<7|LhMO{et1MT8mD$RrK_30;GC#_!Sl*ZX~RST=@J#%-6
zFn`VpA$w!qLmiqlhrs9Olcvzm!X=B8B9An`<<T>$Q(zwbl|qt7GrpEhjkb>mouNF6
zM*dNd=DfyR(VtLiD8dy+O(oofXB5tN)M%Wb8+WwN+VjeVd$3;q()B9ZjEn;|v59cY
z#OgtsJl(?KSe?okJZt4aMKF(aTstRNdfuXu#ylTf{WoL2-oZTlHgx11S&N6b)A21r
zDrydZd|my%i$d!vxoj_V(DG`mPp(S3L_*6dQ4WKz+o~k1D`bHI*y15&`-7HEqEv&g
z+ZMjBp2V+*iU8>v1Z6c*romSVW%5;&G!n=Z>9PUsO+>i}VnbnyY>T3_L^|I=C6_36
zVDqQ2L|j!!fuSsLP=XRgdB+cC$VNkQj7TRBC}D}>{!2Tgq$Uj!x-`<>PadKq_!|O6
zh{OqoG{k=!6o{^U1<h<%7SeBr1_#o{2vs|xi0&j&qYU6X>nOp6Iw(<WL27P)^Hx74
z$CI=rk;fiIsrp|%fch6v92hA)*y?8FUXb<za^@%eoBDtCgd9!}rhoBdtCbLwn6fF5
zb2a;CCjMzH#Hb)Uq;;5_t8ag4hcdkH)eX98(#i)_aH6z;H&1re-#aC_IXW;+z+YOx
NKS??OC}4p;{SUo+@zVeR


From 737ae4b17f54e51e31d3fee07753fe4cffa72b1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Hoh?= <joerghoh@users.noreply.github.com>
Date: Wed, 10 Sep 2025 15:53:34 +0200
Subject: [PATCH 08/10] Update
 vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java

Co-authored-by: Konrad Windszus <kwin@apache.org>
---
 .../java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
index 995f1989c..59350b6df 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
@@ -500,7 +500,7 @@ public void setSkipFilterChecksOnImport (boolean skipFilterChecksOnImport) {
      * get the filter check skip policy
      * @return true if the filter check is skipped
      */
-    public boolean getskipFilterChecksOnImport() {
+    public boolean getSkipFilterChecksOnImport() {
         return this.skipFilterChecksOnImport;
     }
 

From abe7a411b830eae09ae4178860da0afdfd1b44cf Mon Sep 17 00:00:00 2001
From: Joerg Hoh <jhoh@adobe.com>
Date: Wed, 10 Sep 2025 16:22:22 +0200
Subject: [PATCH 09/10] PR feedback

---
 .../vault/fs/config/DefaultWorkspaceFilter.java     | 13 -------------
 .../vault/fs/impl/io/AbstractArtifactHandler.java   |  8 ++++----
 .../vault/fs/impl/io/DocViewImporter.java           | 10 ++++------
 .../vault/fs/impl/io/FileArtifactHandler.java       |  4 ++--
 .../vault/fs/impl/io/GenericArtifactHandler.java    |  2 +-
 .../org/apache/jackrabbit/vault/fs/io/Importer.java |  5 -----
 6 files changed, 11 insertions(+), 31 deletions(-)

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
index 5e76a7a20..4cda709fa 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
@@ -105,11 +105,6 @@ public class DefaultWorkspaceFilter implements Dumpable, WorkspaceFilter {
      */
     private ImportMode importMode;
 
-    /**
-     * skip filter checks when importing content
-     */
-    private boolean skipFilterChecksOnImport = false;
-
     /**
      * Add a #PathFilterSet for nodes items.
      * @param set the set of filters to add.
@@ -237,14 +232,6 @@ public void setImportMode(ImportMode importMode) {
         this.importMode = importMode;
     }
 
-    public void setSkipFilterChecksOnImport(boolean skipFilterChecksOnImport) {
-        this.skipFilterChecksOnImport = skipFilterChecksOnImport;
-    }
-
-    public boolean getSkipFilterChecksOnImport() {
-        return this.skipFilterChecksOnImport;
-    }
-
     /**
      * {@inheritDoc}
      */
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/AbstractArtifactHandler.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/AbstractArtifactHandler.java
index 89d664301..f691e821a 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/AbstractArtifactHandler.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/AbstractArtifactHandler.java
@@ -162,12 +162,12 @@ public void dump(DumpContext ctx, boolean isLast) {
         ctx.println(isLast, getClass().getSimpleName());
     }
 
-    protected ImportInfoImpl importDocView(InputSource source, Node parentNode, String rootNodeName, ArtifactSetImpl artifacts, WorkspaceFilter wspFilter, IdConflictPolicy idConflictPolicy) throws IOException, RepositoryException {
-        return importDocView(source, parentNode, rootNodeName, artifacts, true, wspFilter, idConflictPolicy);
+    protected ImportInfoImpl importDocView(InputSource source, Node parentNode, String rootNodeName, ArtifactSetImpl artifacts, WorkspaceFilter wspFilter, IdConflictPolicy idConflictPolicy, boolean skipFilterChecksOnImport) throws IOException, RepositoryException {
+        return importDocView(source, parentNode, rootNodeName, artifacts, true, wspFilter, idConflictPolicy, skipFilterChecksOnImport);
     }
 
-    protected ImportInfoImpl importDocView(InputSource source, Node parentNode, String rootNodeName, ArtifactSetImpl artifacts, boolean isStrict, WorkspaceFilter wspFilter, IdConflictPolicy idConflictPolicy) throws IOException, RepositoryException {
-        DocViewImporter handler = new DocViewImporter(parentNode, rootNodeName, artifacts, wspFilter, idConflictPolicy, getAcHandling(), getCugHandling());
+    protected ImportInfoImpl importDocView(InputSource source, Node parentNode, String rootNodeName, ArtifactSetImpl artifacts, boolean isStrict, WorkspaceFilter wspFilter, IdConflictPolicy idConflictPolicy, boolean skipFilterChecksOnImport) throws IOException, RepositoryException {
+        DocViewImporter handler = new DocViewImporter(parentNode, rootNodeName, artifacts, wspFilter, idConflictPolicy, getAcHandling(), getCugHandling(), skipFilterChecksOnImport);
         String rootNodePath = parentNode.getPath();
         if (!rootNodePath.equals("/")) {
             rootNodePath += "/";
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java
index dda27b9d2..b2c78263a 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java
@@ -242,12 +242,12 @@ public class DocViewImporter implements DocViewParserHandler {
      * @throws RepositoryException if an error occurs.
      */
     public DocViewImporter(Node parentNode, String rootNodeName,
-                              ArtifactSetImpl artifacts, WorkspaceFilter wspFilter, IdConflictPolicy idConflictPolicy) throws RepositoryException {
-        this(parentNode, rootNodeName, artifacts, wspFilter, idConflictPolicy, AccessControlHandling.IGNORE, null);
+                              ArtifactSetImpl artifacts, WorkspaceFilter wspFilter, IdConflictPolicy idConflictPolicy, boolean skipFilterChecksOnImport) throws RepositoryException {
+        this(parentNode, rootNodeName, artifacts, wspFilter, idConflictPolicy, AccessControlHandling.IGNORE, null, skipFilterChecksOnImport);
     }
 
     public DocViewImporter(Node parentNode, String rootNodeName,
-            ArtifactSetImpl artifacts, WorkspaceFilter wspFilter, IdConflictPolicy idConflictPolicy, AccessControlHandling aclHandling, AccessControlHandling cugHandling) throws RepositoryException {
+            ArtifactSetImpl artifacts, WorkspaceFilter wspFilter, IdConflictPolicy idConflictPolicy, AccessControlHandling aclHandling, AccessControlHandling cugHandling, boolean skipFilterChecksOnImport) throws RepositoryException {
         this.filter = artifacts.getCoverage();
         this.wspFilter = wspFilter;
         this.rootDepth = parentNode.getDepth() + 1;
@@ -280,9 +280,7 @@ public DocViewImporter(Node parentNode, String rootNodeName,
         stack = new StackElement(parentNode, parentNode.isNew());
         npResolver = new DefaultNamePathResolver(parentNode.getSession());
 
-        if (wspFilter instanceof DefaultWorkspaceFilter) {
-            skipFilterChecksOnImport = ((DefaultWorkspaceFilter) wspFilter).getSkipFilterChecksOnImport();
-        }
+        this.skipFilterChecksOnImport = skipFilterChecksOnImport;
     }
 
     /**
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/FileArtifactHandler.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/FileArtifactHandler.java
index 6a265cdb8..ab1328171 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/FileArtifactHandler.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/FileArtifactHandler.java
@@ -228,7 +228,7 @@ public ImportInfoImpl accept(@NotNull ImportOptions options, boolean isStrictByD
                         mode = wspFilter.getImportMode(path);
                     }
                     if (mode != ImportMode.MERGE) {
-                        info.merge(importDocView(file.getInputSource(), newParent, newName, newSet, wspFilter, options.getIdConflictPolicy()));
+                        info.merge(importDocView(file.getInputSource(), newParent, newName, newSet, wspFilter, options.getIdConflictPolicy(), options.getSkipFilterChecksOnImport()));
                     } else {
                         info.onNop(path);
                     }
@@ -315,7 +315,7 @@ private ImportInfoImpl importDocView(Node parent, InputSource source,
         if (idx > 0) {
             rootName = rootName.substring(0, idx);
         }
-        return importDocView(source, parent, rootName, artifacts, wspFilter, options.getIdConflictPolicy());
+        return importDocView(source, parent, rootName, artifacts, wspFilter, options.getIdConflictPolicy(),options.getSkipFilterChecksOnImport());
     }
 
     private boolean importNtResource(ImportInfo info, Node content, Artifact artifact)
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/GenericArtifactHandler.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/GenericArtifactHandler.java
index e0da8ea66..3364222e3 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/GenericArtifactHandler.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/GenericArtifactHandler.java
@@ -85,7 +85,7 @@ public ImportInfoImpl accept(@NotNull ImportOptions options, boolean isStrictByD
                     }
                 }
             }
-            info.merge(importDocView(source, parent, name, artifacts, options.isStrict(isStrictByDefault), wspFilter, options.getIdConflictPolicy()));
+            info.merge(importDocView(source, parent, name, artifacts, options.isStrict(isStrictByDefault), wspFilter, options.getIdConflictPolicy(), options.getSkipFilterChecksOnImport()));
         }
         return info;
     }
diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java
index 8a9e66ff5..844e1aa26 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/Importer.java
@@ -494,11 +494,6 @@ public void run(Archive archive, Session session, String parentPath)
                 log.warn("Unable to override import mode, incompatible filter: {}", filter.getClass().getName());
             }
         }
-        if (filter instanceof DefaultWorkspaceFilter) {
-            ((DefaultWorkspaceFilter) filter).setSkipFilterChecksOnImport(opts.getskipFilterChecksOnImport());
-        } else {
-            log.warn("Unable to overwrite 'skipFilterChecksOnImport', incompatible filter: {}", filter.getClass().getName());
-        }
         // build filter tree
         for (PathFilterSet set: filter.getFilterSets()) {
             filterTree.put(set.getRoot(), set);

From e16806c7d50e648e088ccfb018066f07979bcc08 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Hoh?= <joerghoh@users.noreply.github.com>
Date: Wed, 10 Sep 2025 16:30:27 +0200
Subject: [PATCH 10/10] Update
 vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java

Co-authored-by: Konrad Windszus <kwin@apache.org>
---
 .../java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
index 59350b6df..adde2114c 100644
--- a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
+++ b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ImportOptions.java
@@ -486,7 +486,7 @@ public void setIdConflictPolicy(@NotNull IdConflictPolicy idConflictPolicy) {
 
     /**
      * Allows to skip filter checks when importing packages; you can set this
-     * to {{code true}} if you are sure that there this package contains no content
+     * to {{code true}} if you are sure that this package contains no content
      * which would be rejected by filters.
      * This only affects checks against items in the package, but not existing items in
      * the repository.