From 019b2c69bd5b8cf8fa9a21bd5c4479204b27cb36 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Wed, 08 Jul 2026 16:05:46 +0000
Subject: [PATCH] [#665] Fix StackOverflowError while parsing long ACI with repetitive targets (#666)
---
opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargetAttr.java | 12 +++++++-----
1 files changed, 7 insertions(+), 5 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargetAttr.java b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargetAttr.java
index 3c581ce..c07a6c4 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargetAttr.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/authorization/dseecompat/TargetAttr.java
@@ -13,6 +13,7 @@
*
* Copyright 2008 Sun Microsystems, Inc.
* Portions Copyright 2012-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC
*/
package org.opends.server.authorization.dseecompat;
@@ -45,12 +46,13 @@
/**
* Regular expression that matches one or more ATTR_NAME's separated by
- * the "||" token.
+ * the "||" token. Possessive quantifiers keep the unbounded repetition
+ * from recursing in the regex engine (issue #665).
*/
- private static final String attrListRegex = ZERO_OR_MORE_WHITESPACE +
- ATTR_NAME + ZERO_OR_MORE_WHITESPACE + "(" +
- LOGICAL_OR + ZERO_OR_MORE_WHITESPACE + ATTR_NAME +
- ZERO_OR_MORE_WHITESPACE + ")*";
+ private static final String attrListRegex = ZERO_OR_MORE_WHITESPACE_POSSESSIVE +
+ ATTR_NAME + ZERO_OR_MORE_WHITESPACE_POSSESSIVE + "(" +
+ LOGICAL_OR + ZERO_OR_MORE_WHITESPACE_POSSESSIVE + ATTR_NAME +
+ ZERO_OR_MORE_WHITESPACE_POSSESSIVE + ")*+";
/**
* Constructor creating a class representing a targetattr keyword of an ACI.
--
Gitblit v1.10.0