henrib opened a new pull request, #414: URL: https://github.com/apache/commons-jexl/pull/414
## Summary Runtime hardening PR addressing three security concerns: 1. **Regex matching interruptibility** — Make `=~` / `!~` operators responsive to thread interruption, preventing indefinite hangs on catastrophic backtracking patterns. Includes pattern caching in AST nodes to avoid recompilation. 2. **BigInteger arithmetic precision bounds** — Enforce `MathContext` precision limits on BigInteger results to prevent unbounded growth and memory exhaustion. 3. **BigInteger literal parsing DoS prevention** — Cap parse-time digit count to prevent O(n²) complexity attacks via huge literals. ## Changes - **Interpreter.java** — `resolvePattern()` caches compiled `Pattern` objects in AST node value slots for string literals - **JexlArithmetic.java** — `InterruptibleCharSequence` wrapper with 256-char interrupt sampling, regex length guard (2048 chars), hoist precision check outside try-catch - **Operator.java** — detect thread interruption and signal `JexlException.Cancel` - **NumberParser.java** — cap BigInteger literal digit count via `MathContext.getPrecision()` - **Parser.jjt** — wrap `NumberFormatException` as `JexlException.Parsing` - **ArithmeticTest.java** — four new test methods covering all three fixes - **changes.xml** — release notes entry ## Tests All 1204 tests passing: - `testRegexMatchingInterruptible()` - `testRegexPatternTooLong()` - `testBigIntegerArithmeticPrecisionCap()` - `testBigIntegerLiteralTooLong()` 🤖 Generated with Claude Code -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
