(commons-beanutils) branch master updated: Reject out-of-range color components in ColorConverter (#420)

[ggregory]

This is an automated email from the ASF dual-hosted git repository.

garydgregory pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-beanutils.git


The following commit(s) were added to refs/heads/master by this push:
     new 2a696ccf Reject out-of-range color components in ColorConverter (#420)
2a696ccf is described below

commit 2a696ccfc6f6d9dd9acf206eb2268a67924e5a91
Author: Naveed Khan <164054284+rootvect...@users.noreply.github.com>
AuthorDate: Fri Jul 17 14:20:46 2026 +0000

    Reject out-of-range color components in ColorConverter (#420)
    
    the `JAVA_COLOR_PATTERN` label prefix included `\d`, so a bare triple like 
`1234,5,6` had its leading digit absorbed by the label and parsed as `4,5,6`, 
silently bypassing the `> 255` range check. bind the optional class-name label 
to its `[` so it can no longer eat digits from the numeric groups.
---
 .../org/apache/commons/beanutils2/converters/ColorConverter.java   | 2 +-
 .../apache/commons/beanutils2/converters/ColorConverterTest.java   | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git 
a/src/main/java/org/apache/commons/beanutils2/converters/ColorConverter.java 
b/src/main/java/org/apache/commons/beanutils2/converters/ColorConverter.java
index 86723384..092a9558 100644
--- a/src/main/java/org/apache/commons/beanutils2/converters/ColorConverter.java
+++ b/src/main/java/org/apache/commons/beanutils2/converters/ColorConverter.java
@@ -39,7 +39,7 @@ public class ColorConverter extends AbstractConverter<Color> {
     private static final String HEX_COLOR_PREFIX = "#";
 
     /** Regular expression matching the output of {@link Color#toString()}. */
-    private static final Pattern JAVA_COLOR_PATTERN = 
Pattern.compile("^(?:[A-Za-z\\d._]+)??\\[?(?:r=)?(\\d{1,3}),(?:g=)?(\\d{1,3}),(?:b=)?(\\d{1,3})\\]?$");
+    private static final Pattern JAVA_COLOR_PATTERN = 
Pattern.compile("^(?:[A-Za-z\\d._]*\\[)?(?:r=)?(\\d{1,3}),(?:g=)?(\\d{1,3}),(?:b=)?(\\d{1,3})\\]?$");
 
     /**
      * Construct a <strong>{@link Color}</strong> <em>Converter</em> that 
throws a {@code ConversionException} if an error occurs.
diff --git 
a/src/test/java/org/apache/commons/beanutils2/converters/ColorConverterTest.java
 
b/src/test/java/org/apache/commons/beanutils2/converters/ColorConverterTest.java
index ed809cd0..5261bce3 100644
--- 
a/src/test/java/org/apache/commons/beanutils2/converters/ColorConverterTest.java
+++ 
b/src/test/java/org/apache/commons/beanutils2/converters/ColorConverterTest.java
@@ -105,6 +105,13 @@ class ColorConverterTest {
         assertEquals(expected, actual);
     }
 
+    @Test
+    void testConvertingOutOfRangeComponentRejected() {
+        assertThrows(ConversionException.class, () -> 
converter.convert(Color.class, "1234,5,6"));
+        assertThrows(ConversionException.class, () -> 
converter.convert(Color.class, "1000,0,0"));
+        assertThrows(ConversionException.class, () -> 
converter.convert(Color.class, "2550,0,0"));
+    }
+
     @Test
     void testConvertingLiteralHex() {
         final Color expected = Color.BLUE;