From 019b2c69bd5b8cf8fa9a21bd5c4479204b27cb36 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 08 Jul 2026 16:05:46 +0000
Subject: [PATCH] [#665] Fix StackOverflowError while parsing long ACI with repetitive targets (#666)
---
opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/Permission.java | 15 ++++++++++-----
1 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/Permission.java b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/Permission.java
index 91b09c6..3e49a35 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/Permission.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/Permission.java
@@ -13,6 +13,7 @@
*
* Copyright 2008 Sun Microsystems, Inc.
* Portions Copyright 2013-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC
*/
package org.opends.server.authorization.dseecompat;
@@ -34,11 +35,15 @@
/** Regular expression token representing the separator. */
private static final String separatorToken = ",";
- /** Regular expression used to match the ACI rights string. */
- private static final String rightsRegex = ZERO_OR_MORE_WHITESPACE +
- WORD_GROUP + ZERO_OR_MORE_WHITESPACE +
- "(," + ZERO_OR_MORE_WHITESPACE + WORD_GROUP +
- ZERO_OR_MORE_WHITESPACE + ")*";
+ /**
+ * Regular expression used to match the ACI rights string. Possessive
+ * quantifiers keep the unbounded repetition from recursing in the regex
+ * engine (issue #665).
+ */
+ private static final String rightsRegex = ZERO_OR_MORE_WHITESPACE_POSSESSIVE +
+ WORD_GROUP_POSSESSIVE + ZERO_OR_MORE_WHITESPACE_POSSESSIVE +
+ "(," + ZERO_OR_MORE_WHITESPACE_POSSESSIVE + WORD_GROUP_POSSESSIVE +
+ ZERO_OR_MORE_WHITESPACE_POSSESSIVE + ")*+";
/** The access type (allow,deny) corresponding to the ACI permission value. */
private final EnumAccessType accessType;
--
Gitblit v1.10.0