This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/ws-neethi.git
commit 9069bcf9d401fbcfff834f26248845f8d51da4b5 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Tue Apr 21 14:48:50 2026 +0100 Put a limit on the number of nested policies --- .../java/org/apache/neethi/AbstractPolicyOperator.java | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/main/java/org/apache/neethi/AbstractPolicyOperator.java b/src/main/java/org/apache/neethi/AbstractPolicyOperator.java index 015c8b2..bdac65a 100644 --- a/src/main/java/org/apache/neethi/AbstractPolicyOperator.java +++ b/src/main/java/org/apache/neethi/AbstractPolicyOperator.java @@ -33,6 +33,15 @@ import org.apache.neethi.util.PolicyComparator; */ public abstract class AbstractPolicyOperator implements PolicyOperator { protected List<PolicyComponent> policyComponents = new ArrayList<PolicyComponent>(); + + /** + * Maximum number of normalised alternatives (All nodes inside the outermost + * ExactlyOne) that policy normalization is permitted to produce. Crafted + * WS-Policy documents can trigger an exponential Cartesian cross-product that + * exhausts the JVM heap; this cap converts that unbounded allocation into a + * fast, predictable RuntimeException. + */ + private static final int MAX_ALTERNATIVES = 10_000; public AbstractPolicyOperator() { @@ -233,6 +242,13 @@ public abstract class AbstractPolicyOperator implements PolicyOperator { crossProductAll.addPolicyComponents(currentAll1.getPolicyComponents()); crossProductAll.addPolicyComponents(currentAll2.getPolicyComponents()); crossProduct.addPolicyComponent(crossProductAll); + + if (crossProduct.getPolicyComponents().size() > MAX_ALTERNATIVES) { + throw new RuntimeException( + "Policy normalization exceeded the maximum number of alternatives (" + + MAX_ALTERNATIVES + "). The policy may be crafted to cause " + + "Algorithmic Complexity DoS via exponential cross-product expansion."); + } } }
