Skip to content

Fixes StackOverflow in JavaDetectionEngine:resolveValues #529

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
san-zrl wants to merge 3 commits into from
+51 −25
Closed

Fixes StackOverflow in JavaDetectionEngine:resolveValues #529

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5d1215d
Fixes StackOverflow in JavaDetectionEngine:resolveValues; constructor…
san-zrl Aug 31, 2026
30ccb77
Temporarlily disabled CBOM generation
san-zrl Aug 31, 2026
c644c54
Sent repetitive log msg to trace
san-zrl Aug 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 11 additions & 11 deletions .github/workflows/maven.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,14 +50,14 @@ jobs:
- name: Update dependency graph
uses: advanced-security/maven-dependency-submission-action@v5
if: github.event_name != 'pull_request'
- name: Create CBOM
uses: cbomkit/cbomkit-action@v2.2.0
id: cbom
# Persist CBOM after a job has completed and share
# that CBOM with another job in the same workflow.
- name: Commit changes to new branch
uses: actions/upload-artifact@v7
with:
name: "CBOM"
path: ${{ steps.cbom.outputs.pattern }}
if-no-files-found: warn
#- name: Create CBOM
# uses: cbomkit/cbomkit-action@v2.2.0
# id: cbom
# # Persist CBOM after a job has completed and share
# # that CBOM with another job in the same workflow.
#- name: Commit changes to new branch
# uses: actions/upload-artifact@v7
# with:
# name: "CBOM"
# path: ${{ steps.cbom.outputs.pattern }}
# if-no-files-found: warn
54 changes: 40 additions & 14 deletions engine/src/main/java/com/ibm/engine/language/java/JavaDetectionEngine.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,10 +48,12 @@
import com.ibm.engine.rule.Parameter;
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashSet;
import java.util.LinkedList;
import java.util.List;
import java.util.Objects;
import java.util.Optional;
import java.util.Set;
import java.util.stream.Collectors;
import javax.annotation.Nonnull;
import javax.annotation.Nullable;
Expand Down Expand Up @@ -301,7 +303,8 @@ public <O> List<ResolvedValue<O, Tree>> resolveValuesInInnerScope(
@Nonnull Tree expression,
@Nullable IValueFactory<Tree> valueFactory) {
if (expression instanceof ExpressionTree expressionTree) {
return resolveValues(clazz, expressionTree, valueFactory, new LinkedList<>());
return resolveValues(
clazz, expressionTree, valueFactory, new LinkedList<>(), new HashSet<>());
}
return Collections.emptyList();
}
Expand All @@ -312,14 +315,19 @@ private <O> List<ResolvedValue<O, Tree>> resolveValues(
@Nonnull Class<O> clazz,
@Nonnull ExpressionTree tree,
@Nullable IValueFactory<Tree> valueFactory,
@Nonnull LinkedList<Tree> selections) {
@Nonnull LinkedList<Tree> selections,
@Nonnull Set<Symbol> visited) {
if (selections.size() > 15) {
return Collections.emptyList();
} else if (tree.is(Tree.Kind.IDENTIFIER)) {
IdentifierTree identifierTree = (IdentifierTree) tree;
if (identifierTree.symbol().isVariableSymbol()) {
// variable
VariableTree variableTree = (VariableTree) identifierTree.symbol().declaration();
Symbol symbol = identifierTree.symbol();
if (!visited.add(symbol)) {
return Collections.emptyList();
}
VariableTree variableTree = (VariableTree) symbol.declaration();
if (variableTree != null) {
LinkedList<ResolvedValue<O, Tree>> result = new LinkedList<>();

Expand All @@ -338,7 +346,8 @@ private <O> List<ResolvedValue<O, Tree>> resolveValues(
clazz,
assignment.expression(),
valueFactory,
selections));
selections,
visited));
}
}
}
Expand All @@ -350,7 +359,8 @@ private <O> List<ResolvedValue<O, Tree>> resolveValues(
if (value.isPresent()) {
result.addFirst(new ResolvedValue<>(value.get(), initializer));
} else {
return resolveValues(clazz, initializer, valueFactory, selections);
return resolveValues(
clazz, initializer, valueFactory, selections, visited);
}
}
return result;
Expand Down Expand Up @@ -385,17 +395,26 @@ private <O> List<ResolvedValue<O, Tree>> resolveValues(
(MemberSelectExpressionTree) tree;
selections.addFirst(memberSelectExpressionTree);
return resolveValues(
clazz, memberSelectExpressionTree.expression(), valueFactory, selections);
clazz,
memberSelectExpressionTree.expression(),
valueFactory,
selections,
visited);
}
return List.of(new ResolvedValue<>(value.get(), tree));
} else if (tree.is(Tree.Kind.METHOD_INVOCATION)) {
MethodInvocationTree methodInvocationTree = (MethodInvocationTree) tree;
selections.addFirst(methodInvocationTree);
final List<ResolvedValue<O, Tree>> resolvedValues =
resolveJavaProperties(clazz, methodInvocationTree, valueFactory, selections);
resolveJavaProperties(
clazz, methodInvocationTree, valueFactory, selections, visited);
if (resolvedValues.isEmpty()) {
return resolveValues(
clazz, methodInvocationTree.methodSelect(), valueFactory, selections);
clazz,
methodInvocationTree.methodSelect(),
valueFactory,
selections,
visited);
} else {
return resolvedValues;
}
Expand All @@ -409,7 +428,8 @@ private <O> List<ResolvedValue<O, Tree>> resolveValues(
ArrayDimensionTree dimensionTree = dimensionTrees.get(0);
ExpressionTree dimensionDefinition = dimensionTree.expression();
if (dimensionDefinition != null) {
return resolveValues(clazz, dimensionDefinition, valueFactory, selections);
return resolveValues(
clazz, dimensionDefinition, valueFactory, selections, visited);
}
} else if (dimensionTrees.size() > 1) {
LOGGER.info(
Expand All @@ -419,7 +439,8 @@ private <O> List<ResolvedValue<O, Tree>> resolveValues(
ListTree<ExpressionTree> initializers = newArrayTree.initializers();
final List<ResolvedValue<O, Tree>> values = new ArrayList<>();
for (ExpressionTree initializer : initializers) {
values.addAll(resolveValues(clazz, initializer, valueFactory, selections));
values.addAll(
resolveValues(clazz, initializer, valueFactory, selections, visited));
}
return values;
}
Expand All @@ -428,9 +449,9 @@ private <O> List<ResolvedValue<O, Tree>> resolveValues(
selections.addFirst(newClassTree);
if (newClassTree.arguments().size() == 1) {
ExpressionTree expressionTree = newClassTree.arguments().get(0);
return resolveValues(clazz, expressionTree, valueFactory, selections);
return resolveValues(clazz, expressionTree, valueFactory, selections, visited);
} else if (newClassTree.arguments().size() > 1) {
LOGGER.info(
LOGGER.trace(
"Detected constructor definition has more then one argument to resolve. Redefine the rule to explicitly define the param to resolve");
}
} else {
Expand All @@ -446,7 +467,8 @@ private <O> List<ResolvedValue<O, Tree>> resolveJavaProperties(
@Nonnull Class<O> clazz,
@Nonnull MethodInvocationTree methodInvocationTree,
@Nullable IValueFactory<Tree> valueFactory,
@Nonnull LinkedList<Tree> selections) {
@Nonnull LinkedList<Tree> selections,
@Nonnull Set<Symbol> visited) {
final MatchContext matchContext = new MatchContext(false, false, List.of());
final MethodMatcher<Tree> javaPropertyWithDefaultValueMatcher =
new MethodMatcher<>(
Expand All @@ -460,7 +482,11 @@ private <O> List<ResolvedValue<O, Tree>> resolveJavaProperties(
return Collections.emptyList();
}
return resolveValues(
clazz, methodInvocationTree.arguments().get(1), valueFactory, selections);
clazz,
methodInvocationTree.arguments().get(1),
valueFactory,
selections,
visited);
}
return Collections.emptyList();
}
Expand Down
Loading