From 06b0dab536963da78dadf2ba407e5937d81c348a Mon Sep 17 00:00:00 2001
From: Oliver Gierke <ogierke@pivotal.io>
Date: Tue, 3 Apr 2018 19:01:15 +0200
Subject: [PATCH] DATACMNS-1285 - PropertyPath now limits the depth of its
 parsing to 1000 segments.

---
 .../data/mapping/PropertyPath.java            |  6 +++++
 .../data/mapping/PropertyPathUnitTests.java   | 27 +++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/src/main/java/org/springframework/data/mapping/PropertyPath.java b/src/main/java/org/springframework/data/mapping/PropertyPath.java
index c26d5caa8..ca67478bf 100644
--- a/src/main/java/org/springframework/data/mapping/PropertyPath.java
+++ b/src/main/java/org/springframework/data/mapping/PropertyPath.java
@@ -46,6 +46,8 @@ import org.springframework.util.StringUtils;
 @EqualsAndHashCode
 public class PropertyPath implements Streamable<PropertyPath> {
 
+	private static final String PARSE_DEPTH_EXCEEDED = "Trying to parse a path with depth greater than 1000! This has been disabled for security reasons to prevent parsing overflows.";
+
 	private static final String DELIMITERS = "_\\.";
 	private static final String ALL_UPPERCASE = "[A-Z0-9._$]+";
 	private static final Pattern SPLITTER = Pattern.compile("(?:[%s]?([%s]*?[^%s]+))".replaceAll("%s", DELIMITERS));
@@ -366,6 +368,10 @@ public class PropertyPath implements Streamable<PropertyPath> {
 	 */
 	private static PropertyPath create(String source, TypeInformation<?> type, String addTail, List<PropertyPath> base) {
 
+		if (base.size() > 1000) {
+			throw new IllegalArgumentException(PARSE_DEPTH_EXCEEDED);
+		}
+
 		PropertyReferenceException exception = null;
 		PropertyPath current = null;
 
diff --git a/src/test/java/org/springframework/data/mapping/PropertyPathUnitTests.java b/src/test/java/org/springframework/data/mapping/PropertyPathUnitTests.java
index f79cee857..a04cb6063 100755
--- a/src/test/java/org/springframework/data/mapping/PropertyPathUnitTests.java
+++ b/src/test/java/org/springframework/data/mapping/PropertyPathUnitTests.java
@@ -369,6 +369,23 @@ public class PropertyPathUnitTests {
 				.withMessageContaining("Bar.user");
 	}
 
+	@Test // DATACMNS-1285
+	public void rejectsTooLongPath() {
+
+		String source = "foo.bar";
+
+		for (int i = 0; i < 9; i++) {
+			source = source + "." + source;
+		}
+
+		assertThat(source.split("\\.").length).isGreaterThan(1000);
+
+		final String path = source;
+
+		assertThatExceptionOfType(IllegalArgumentException.class) //
+				.isThrownBy(() -> PropertyPath.from(path, Left.class));
+	}
+
 	private class Foo {
 
 		String userName;
@@ -403,4 +420,14 @@ public class PropertyPathUnitTests {
 		private FooBar user;
 		private Foo _foo;
 	}
+
+	// DATACMNS-1285
+
+	private class Left {
+		Right foo;
+	}
+
+	private class Right {
+		Left bar;
+	}
 }