From 5d1215d52558b5d6d4a849c0bcb5e1af21ec57ad Mon Sep 17 00:00:00 2001 From: san-zrl Date: Mon, 31 Aug 2026 10:00:44 +0200 Subject: [PATCH 1/3] Fixes StackOverflow in JavaDetectionEngine:resolveValues; constructor log msg at debug lvl Signed-off-by: san-zrl --- .../language/java/JavaDetectionEngine.java | 54 ++++++++++++++----- 1 file changed, 40 insertions(+), 14 deletions(-) diff --git a/engine/src/main/java/com/ibm/engine/language/java/JavaDetectionEngine.java b/engine/src/main/java/com/ibm/engine/language/java/JavaDetectionEngine.java index 99e800e46..3096d0fb7 100644 --- a/engine/src/main/java/com/ibm/engine/language/java/JavaDetectionEngine.java +++ b/engine/src/main/java/com/ibm/engine/language/java/JavaDetectionEngine.java @@ -48,10 +48,12 @@ import com.ibm.engine.rule.Parameter; import java.util.ArrayList; import java.util.Collections; +import java.util.HashSet; import java.util.LinkedList; import java.util.List; import java.util.Objects; import java.util.Optional; +import java.util.Set; import java.util.stream.Collectors; import javax.annotation.Nonnull; import javax.annotation.Nullable; @@ -301,7 +303,8 @@ public List> resolveValuesInInnerScope( @Nonnull Tree expression, @Nullable IValueFactory valueFactory) { if (expression instanceof ExpressionTree expressionTree) { - return resolveValues(clazz, expressionTree, valueFactory, new LinkedList<>()); + return resolveValues( + clazz, expressionTree, valueFactory, new LinkedList<>(), new HashSet<>()); } return Collections.emptyList(); } @@ -312,14 +315,19 @@ private List> resolveValues( @Nonnull Class clazz, @Nonnull ExpressionTree tree, @Nullable IValueFactory valueFactory, - @Nonnull LinkedList selections) { + @Nonnull LinkedList selections, + @Nonnull Set visited) { if (selections.size() > 15) { return Collections.emptyList(); } else if (tree.is(Tree.Kind.IDENTIFIER)) { IdentifierTree identifierTree = (IdentifierTree) tree; if (identifierTree.symbol().isVariableSymbol()) { // variable - VariableTree variableTree = (VariableTree) identifierTree.symbol().declaration(); + Symbol symbol = identifierTree.symbol(); + if (!visited.add(symbol)) { + return Collections.emptyList(); + } + VariableTree variableTree = (VariableTree) symbol.declaration(); if (variableTree != null) { LinkedList> result = new LinkedList<>(); @@ -338,7 +346,8 @@ private List> resolveValues( clazz, assignment.expression(), valueFactory, - selections)); + selections, + visited)); } } } @@ -350,7 +359,8 @@ private List> resolveValues( if (value.isPresent()) { result.addFirst(new ResolvedValue<>(value.get(), initializer)); } else { - return resolveValues(clazz, initializer, valueFactory, selections); + return resolveValues( + clazz, initializer, valueFactory, selections, visited); } } return result; @@ -385,17 +395,26 @@ private List> resolveValues( (MemberSelectExpressionTree) tree; selections.addFirst(memberSelectExpressionTree); return resolveValues( - clazz, memberSelectExpressionTree.expression(), valueFactory, selections); + clazz, + memberSelectExpressionTree.expression(), + valueFactory, + selections, + visited); } return List.of(new ResolvedValue<>(value.get(), tree)); } else if (tree.is(Tree.Kind.METHOD_INVOCATION)) { MethodInvocationTree methodInvocationTree = (MethodInvocationTree) tree; selections.addFirst(methodInvocationTree); final List> resolvedValues = - resolveJavaProperties(clazz, methodInvocationTree, valueFactory, selections); + resolveJavaProperties( + clazz, methodInvocationTree, valueFactory, selections, visited); if (resolvedValues.isEmpty()) { return resolveValues( - clazz, methodInvocationTree.methodSelect(), valueFactory, selections); + clazz, + methodInvocationTree.methodSelect(), + valueFactory, + selections, + visited); } else { return resolvedValues; } @@ -409,7 +428,8 @@ private List> resolveValues( ArrayDimensionTree dimensionTree = dimensionTrees.get(0); ExpressionTree dimensionDefinition = dimensionTree.expression(); if (dimensionDefinition != null) { - return resolveValues(clazz, dimensionDefinition, valueFactory, selections); + return resolveValues( + clazz, dimensionDefinition, valueFactory, selections, visited); } } else if (dimensionTrees.size() > 1) { LOGGER.info( @@ -419,7 +439,8 @@ private List> resolveValues( ListTree initializers = newArrayTree.initializers(); final List> values = new ArrayList<>(); for (ExpressionTree initializer : initializers) { - values.addAll(resolveValues(clazz, initializer, valueFactory, selections)); + values.addAll( + resolveValues(clazz, initializer, valueFactory, selections, visited)); } return values; } @@ -428,9 +449,9 @@ private List> resolveValues( selections.addFirst(newClassTree); if (newClassTree.arguments().size() == 1) { ExpressionTree expressionTree = newClassTree.arguments().get(0); - return resolveValues(clazz, expressionTree, valueFactory, selections); + return resolveValues(clazz, expressionTree, valueFactory, selections, visited); } else if (newClassTree.arguments().size() > 1) { - LOGGER.info( + LOGGER.debug( "Detected constructor definition has more then one argument to resolve. Redefine the rule to explicitly define the param to resolve"); } } else { @@ -446,7 +467,8 @@ private List> resolveJavaProperties( @Nonnull Class clazz, @Nonnull MethodInvocationTree methodInvocationTree, @Nullable IValueFactory valueFactory, - @Nonnull LinkedList selections) { + @Nonnull LinkedList selections, + @Nonnull Set visited) { final MatchContext matchContext = new MatchContext(false, false, List.of()); final MethodMatcher javaPropertyWithDefaultValueMatcher = new MethodMatcher<>( @@ -460,7 +482,11 @@ private List> resolveJavaProperties( return Collections.emptyList(); } return resolveValues( - clazz, methodInvocationTree.arguments().get(1), valueFactory, selections); + clazz, + methodInvocationTree.arguments().get(1), + valueFactory, + selections, + visited); } return Collections.emptyList(); } From 30ccb7708153cf16aabf903f11cdc7243307d515 Mon Sep 17 00:00:00 2001 From: san-zrl Date: Mon, 31 Aug 2026 10:36:21 +0200 Subject: [PATCH 2/3] Temporarlily disabled CBOM generation Signed-off-by: san-zrl --- .github/workflows/maven.yml | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index c7d32e9f6..05a724b5d 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -50,14 +50,14 @@ jobs: - name: Update dependency graph uses: advanced-security/maven-dependency-submission-action@v5 if: github.event_name != 'pull_request' - - name: Create CBOM - uses: cbomkit/cbomkit-action@v2.2.0 - id: cbom - # Persist CBOM after a job has completed and share - # that CBOM with another job in the same workflow. - - name: Commit changes to new branch - uses: actions/upload-artifact@v7 - with: - name: "CBOM" - path: ${{ steps.cbom.outputs.pattern }} - if-no-files-found: warn + #- name: Create CBOM + # uses: cbomkit/cbomkit-action@v2.2.0 + # id: cbom + # # Persist CBOM after a job has completed and share + # # that CBOM with another job in the same workflow. + #- name: Commit changes to new branch + # uses: actions/upload-artifact@v7 + # with: + # name: "CBOM" + # path: ${{ steps.cbom.outputs.pattern }} + # if-no-files-found: warn From c644c54afd32a23678040d6eca12959c25540359 Mon Sep 17 00:00:00 2001 From: san-zrl Date: Mon, 31 Aug 2026 12:23:15 +0200 Subject: [PATCH 3/3] Sent repetitive log msg to trace Signed-off-by: san-zrl --- .../java/com/ibm/engine/language/java/JavaDetectionEngine.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/engine/src/main/java/com/ibm/engine/language/java/JavaDetectionEngine.java b/engine/src/main/java/com/ibm/engine/language/java/JavaDetectionEngine.java index 3096d0fb7..75bc26d51 100644 --- a/engine/src/main/java/com/ibm/engine/language/java/JavaDetectionEngine.java +++ b/engine/src/main/java/com/ibm/engine/language/java/JavaDetectionEngine.java @@ -451,7 +451,7 @@ private List> resolveValues( ExpressionTree expressionTree = newClassTree.arguments().get(0); return resolveValues(clazz, expressionTree, valueFactory, selections, visited); } else if (newClassTree.arguments().size() > 1) { - LOGGER.debug( + LOGGER.trace( "Detected constructor definition has more then one argument to resolve. Redefine the rule to explicitly define the param to resolve"); } } else {