henrib commented on code in PR #414:
URL: https://github.com/apache/commons-jexl/pull/414#discussion_r3893899042
##########
src/main/java/org/apache/commons/jexl3/parser/NumberParser.java:
##########
@@ -32,6 +34,30 @@ public final class NumberParser implements Serializable {
*/
private static final long serialVersionUID = 1L;
+ /**
+ * Hard upper bound on BigInteger literal digits when no engine precision
is configured.
+ * Acts as a parse-time DoS guard independent of any MathContext
(JEXL-security f014).
+ */
+ static final int MAX_BIGINTEGER_DIGITS = 256;
+
+ /**
+ * Returns the maximum digit count allowed for a BigInteger literal.
+ * When a JEXL engine with a bounded MathContext is active on the current
thread, the
+ * engine's precision (in decimal digits) is used as the limit; otherwise
MAX_BIGINTEGER_DIGITS applies.
+ * At runtime, JexlArithmetic.checkBigIntegerPrecision() enforces a
stricter bit-length limit
+ * based on the same precision (f014, f013).
+ */
+ private static int maxBigIntegerDigits() {
+ final JexlEngine engine = JexlEngine.getThreadEngine();
+ if (engine != null) {
+ final int precision =
engine.getArithmetic().getMathContext().getPrecision();
+ if (precision > 0) {
+ return precision;
+ }
+ }
+ return MAX_BIGINTEGER_DIGITS;
+ }
Review Comment:
ok
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
