From 371f6590c509c72f8e600f3d05e110941607fbad Mon Sep 17 00:00:00 2001
From: Oliver Gierke <ogierke@pivotal.io>
Date: Tue, 3 Apr 2018 19:01:15 +0200
Subject: [PATCH] DATACMNS-1285 - PropertyPath now limits the depth of its
 parsing to 1000 segments.

---
 .../data/mapping/PropertyPath.java            |  6 ++++
 .../data/mapping/PropertyPathUnitTests.java   | 30 ++++++++++++++++++-
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/springframework/data/mapping/PropertyPath.java b/src/main/java/org/springframework/data/mapping/PropertyPath.java
index 180eece9d..0d8f3ea99 100644
--- a/src/main/java/org/springframework/data/mapping/PropertyPath.java
+++ b/src/main/java/org/springframework/data/mapping/PropertyPath.java
@@ -36,6 +36,8 @@ import org.springframework.util.StringUtils;
  */
 public class PropertyPath implements Iterable<PropertyPath> {
 
+	private static final String PARSE_DEPTH_EXCEEDED = "Trying to parse a path with depth greater than 1000! This has been disabled for security reasons to prevent parsing overflows.";
+
 	private static final String DELIMITERS = "_\\.";
 	private static final String ALL_UPPERCASE = "[A-Z0-9._$]+";
 	private static final Pattern SPLITTER = Pattern.compile("(?:[%s]?([%s]*?[^%s]+))".replaceAll("%s", DELIMITERS));
@@ -321,6 +323,10 @@ public class PropertyPath implements Iterable<PropertyPath> {
 	 */
 	private static PropertyPath create(String source, TypeInformation<?> type, String addTail, List<PropertyPath> base) {
 
+		if (base.size() > 1000) {
+			throw new IllegalArgumentException(PARSE_DEPTH_EXCEEDED);
+		}
+
 		PropertyReferenceException exception = null;
 		PropertyPath current = null;
 
diff --git a/src/test/java/org/springframework/data/mapping/PropertyPathUnitTests.java b/src/test/java/org/springframework/data/mapping/PropertyPathUnitTests.java
index 4e62e9edf..429796f58 100644
--- a/src/test/java/org/springframework/data/mapping/PropertyPathUnitTests.java
+++ b/src/test/java/org/springframework/data/mapping/PropertyPathUnitTests.java
@@ -1,5 +1,5 @@
 /*
- * Copyright 2011-2017 the original author or authors.
+ * Copyright 2011-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -346,6 +346,24 @@ public class PropertyPathUnitTests {
 		from("userAme", Foo.class);
 	}
 
+	@Test // DATACMNS-1285
+	public void rejectsTooLongPath() {
+
+		String source = "foo.bar";
+
+		for (int i = 0; i < 9; i++) {
+			source = source + "." + source;
+		}
+
+		assertThat(source.split("\\.").length, is(greaterThan(1000)));
+
+		final String path = source;
+
+		exception.expect(IllegalArgumentException.class);
+
+		PropertyPath.from(path, Left.class);
+	}
+
 	private class Foo {
 
 		String userName;
@@ -379,4 +397,14 @@ public class PropertyPathUnitTests {
 		private FooBar user;
 		private Foo _foo;
 	}
+
+	// DATACMNS-1285
+
+	private class Left {
+		Right foo;
+	}
+
+	private class Right {
+		Left bar;
+	}
 }