(commons-beanutils) branch 1.X updated: Reject out-of-range values in LongLocaleConverter (1.X) (#407)

[ggregory]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch 1.X
in repository https://gitbox.apache.org/repos/asf/commons-beanutils.git


The following commit(s) were added to refs/heads/1.X by this push:
     new 89d299f7 Reject out-of-range values in LongLocaleConverter (1.X) (#407)
89d299f7 is described below

commit 89d299f7b6e50a7c1bcbfa4fa7778d9a8287a4e7
Author: Dexter.k <164054284+rootvect...@users.noreply.github.com>
AuthorDate: Thu Jul 2 19:41:22 2026 +0000

    Reject out-of-range values in LongLocaleConverter (1.X) (#407)
    
    * reject out-of-range values in LongLocaleConverter
    
    LongLocaleConverter.parse narrows the parsed number with longValue()
    and never range-checks it, so a value beyond long range like
    99999999999999999999 is silently clamped to Long.MAX_VALUE instead of
    rejected: DecimalFormat returns it as a Double (the converter does not
    set parseBigDecimal) and Double.longValue() saturates. Add the same
    bounds check the sibling IntegerLocaleConverter, ByteLocaleConverter,
    ShortLocaleConverter and FloatLocaleConverter already apply before
    narrowing.
    
    Signed-off-by: Naveed Khan <dxbnavee...@gmail.com>
    
    * use assertThrows in testLongLimits
    
    Signed-off-by: Naveed Khan <dxbnavee...@gmail.com>
    
    ---------
    
    Signed-off-by: Naveed Khan <dxbnavee...@gmail.com>
---
 .../locale/converters/LongLocaleConverter.java         |  6 ++++++
 .../locale/converters/LongLocaleConverterTest.java     | 18 ++++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git 
a/src/main/java/org/apache/commons/beanutils/locale/converters/LongLocaleConverter.java
 
b/src/main/java/org/apache/commons/beanutils/locale/converters/LongLocaleConverter.java
index cb2ec983..b0456e08 100644
--- 
a/src/main/java/org/apache/commons/beanutils/locale/converters/LongLocaleConverter.java
+++ 
b/src/main/java/org/apache/commons/beanutils/locale/converters/LongLocaleConverter.java
@@ -20,6 +20,8 @@ package org.apache.commons.beanutils.locale.converters;
 import java.text.ParseException;
 import java.util.Locale;
 
+import org.apache.commons.beanutils.ConversionException;
+
 /**
  * Standard {@link org.apache.commons.beanutils.locale.LocaleConverter} 
implementation that converts an incoming locale-sensitive String into a
  * {@code java.lang.Long} object, optionally using a default value or throwing 
a {@link org.apache.commons.beanutils.ConversionException} if a conversion error
@@ -173,6 +175,10 @@ public class LongLocaleConverter extends 
DecimalLocaleConverter {
         if (result == null || result instanceof Long) {
             return result;
         }
+        final double doubleValue = ((Number) result).doubleValue();
+        if (doubleValue < Long.MIN_VALUE || doubleValue > Long.MAX_VALUE) {
+            throw new ConversionException("Supplied number is not of type 
Long: " + result);
+        }
         return Long.valueOf(((Number) result).longValue());
     }
 }
diff --git 
a/src/test/java/org/apache/commons/beanutils/locale/converters/LongLocaleConverterTest.java
 
b/src/test/java/org/apache/commons/beanutils/locale/converters/LongLocaleConverterTest.java
index 0d4b3c0d..30c0742c 100644
--- 
a/src/test/java/org/apache/commons/beanutils/locale/converters/LongLocaleConverterTest.java
+++ 
b/src/test/java/org/apache/commons/beanutils/locale/converters/LongLocaleConverterTest.java
@@ -17,6 +17,12 @@
 
 package org.apache.commons.beanutils.locale.converters;
 
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import java.text.DecimalFormat;
+
+import org.apache.commons.beanutils.ConversionException;
+
 /**
  * Test Case for the LongLocaleConverter class.
  *
@@ -225,5 +231,17 @@ public class LongLocaleConverterTest extends 
BaseLocaleConverterTest {
 
     }
 
+    /**
+     * Test Long limits
+     */
+    public void testLongLimits() {
+        converter = new LongLocaleConverter();
+        final DecimalFormat fmt = new DecimalFormat("#");
+        assertEquals(Long.valueOf(Long.MAX_VALUE), 
converter.convert(fmt.format(Long.MAX_VALUE)));
+        assertEquals(Long.valueOf(Long.MIN_VALUE), 
converter.convert(fmt.format(Long.MIN_VALUE)));
+        assertThrows(ConversionException.class, () -> 
converter.convert("99999999999999999999"));
+        assertThrows(ConversionException.class, () -> 
converter.convert("-99999999999999999999"));
+    }
+
 }