gnodet commented on code in PR #12947:
URL: https://github.com/apache/maven/pull/12947#discussion_r3910530033
##########
compat/maven-artifact/src/main/java/org/apache/maven/artifact/versioning/ComparableVersion.java:
##########
@@ -68,6 +68,16 @@ public class ComparableVersion implements
Comparable<ComparableVersion> {
private static final int MAX_LONGITEM_LENGTH = 18;
+ /**
+ * Maximum accepted length of a version string. Version strings routinely
come from external
+ * repository metadata; without a bound, every {@code -} separator nests
another list whose
+ * comparison, equality, hash code and canonicalization recurse one frame
per level, and digit
+ * runs longer than {@value #MAX_LONGITEM_LENGTH} characters are parsed
into {@link BigInteger}
+ * at quadratic cost. 256 characters is far beyond any real-world version
identifier while
+ * keeping the nesting depth (at most about half the length) and numeric
items small.
+ */
+ private static final int MAX_VERSION_LENGTH = 256;
Review Comment:
I sampled versions across Maven Central (via the search API — which only
returns ~200 results per query, so not exhaustive). The longest version I found
was **25 characters**: `9plus-robolectric-5616371` from Robolectric's
`android-all` stubs. Across major ecosystems (Guava, Spring, Netty, Eclipse,
Jetty, Spark, Jackson, AWS SDK, Google Cloud, WildFly, GraalVM, Quarkus
platform, webjars/npm republished…), versions consistently top out around 16–25
characters.
The definitive answer would require querying the [BigQuery public
dataset](https://console.cloud.google.com/bigquery?p=bigquery-public-data&d=maven_central)
(`bigquery-public-data.maven_central`), but based on the sampling, 256 gives
over 10× headroom above the longest real versions on Central. Raising to 1024
would also be fine — there's no performance cost to a higher limit since the
bound just guards against pathological inputs (the commit message notes stack
depths of ~150 frames for a 500-char version string due to the recursive
parser).
The actual breakpoint where things get painful is somewhere around 500+
characters (recursive `parseVersion` → stack overflow) and very large numeric
segments (BigInteger parsing). So anywhere in the 256–1024 range is safe for
all real-world versions while still preventing abuse.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
