Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Infinite Recursion in pom.xml Looped Dependency #297

Closed
xpcmdshell opened this issue Feb 23, 2024 · 2 comments · Fixed by aquasecurity/trivy#6312
Closed

Infinite Recursion in pom.xml Looped Dependency #297

xpcmdshell opened this issue Feb 23, 2024 · 2 comments · Fixed by aquasecurity/trivy#6312
Assignees

Comments

@xpcmdshell
Copy link

There is currently an infinite recursion bug when parsing poms that have looped dependencies. This may occur in a scenario as such:

  • root pom declares module A
  • module A declares another module B
  • B declares a dependency on module A

The parser will endlessly loop between B and A consuming memory until a stack overflow error occurs and the application crashes. Calling Parse on the pom.xml in this minimal reproducer project should demonstrate the behavior.

The parser likely needs a cycle check when parsing dependency to check if the dependency is already one of its ancestors.

Let me know if there's any additional context or reproduction help I can provide. Thanks!

@DmitriyLewen
Copy link
Collaborator

Hello @xpcmdshell
Thanks for your report and example!

Do you have this case with real dependencies?
I want to check the response of the mvn dependency:tree command.

Regards, Dmitriy

@xpcmdshell
Copy link
Author

Hi Dimitriy,

This is a real example that should trigger the same bug: fili

Let me know if there's anything else I can provide, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants