Spring/spring-data-commons
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

DATACMNS-1285 - PropertyPath now limits the depth of its parsing to 1000 segments.

Browse Source
This commit is contained in:
Oliver Gierke
2018-04-03 19:01:15 +02:00
parent 6293ff325b
commit 06b0dab536
2 changed files with 33 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/main/java/org/springframework/data/mapping/PropertyPath.java
View File

@@ -46,6 +46,8 @@ import org.springframework.util.StringUtils;
@EqualsAndHashCode
public class PropertyPath implements Streamable<PropertyPath> {
private static final String PARSE_DEPTH_EXCEEDED = "Trying to parse a path with depth greater than 1000! This has been disabled for security reasons to prevent parsing overflows.";
private static final String DELIMITERS = "_\\.";
private static final String ALL_UPPERCASE = "[A-Z0-9._$]+";
private static final Pattern SPLITTER = Pattern.compile("(?:[%s]?([%s]*?[^%s]+))".replaceAll("%s", DELIMITERS));
@@ -366,6 +368,10 @@ public class PropertyPath implements Streamable<PropertyPath> {
*/
private static PropertyPath create(String source, TypeInformation<?> type, String addTail, List<PropertyPath> base) {
if (base.size() > 1000) {
throw new IllegalArgumentException(PARSE_DEPTH_EXCEEDED);
}
PropertyReferenceException exception = null;
PropertyPath current = null;