The GitHub Actions job "CodeQL" on commons-text.git/security/stringsubstitutor-expansion-limits has failed. Run started by GitHub user kornys (triggered by kornys).
Head commit for run: ddf0a6f6adcabe0b77fe7c0bf8c8c47b2ccb2b80 / David Kornel <[email protected]> StringSubstitutor recursive expansion has a cycle check but no fan-out, depth, or size bound checkCyclicSubstitution() only rejects a variable already on the current substitution stack. It does not bound acyclic fan-out (each of N references expanding to N more) or deep nesting, so a crafted variable map can drive interpolation into exponential output growth or a StackOverflowError without any variable repeating on the stack. Bound substitute() with a maximum interpolation depth (256) and a maximum total output size (16 MiB) per top-level substitution, both raising IllegalStateException. Mirrors the fix for the deprecated commons-lang3 StrSubstitutor (c8dc3121). Report URL: https://github.com/apache/commons-text/actions/runs/35327212504 With regards, GitHub Actions via GitBox
