This is an automated email from the ASF dual-hosted git repository. reschke pushed a commit to branch 1.22 in repository https://gitbox.apache.org/repos/asf/jackrabbit-oak.git
The following commit(s) were added to refs/heads/1.22 by this push: new 107ff75928 OAK-10713: add (failing) list for Lucene regexp stack overflow (#1373) 107ff75928 is described below commit 107ff75928aa0aee7148e4c42abbc18f22d44639 Author: Julian Reschke <resc...@apache.org> AuthorDate: Fri Mar 22 17:58:05 2024 +0100 OAK-10713: add (failing) list for Lucene regexp stack overflow (#1373) --- .../plugins/index/lucene/LuceneSecurityTest.java | 40 ++++++++++++++++++++++ 1 file changed, 40 insertions(+) diff --git a/oak-lucene/src/test/java/org/apache/jackrabbit/oak/plugins/index/lucene/LuceneSecurityTest.java b/oak-lucene/src/test/java/org/apache/jackrabbit/oak/plugins/index/lucene/LuceneSecurityTest.java new file mode 100755 index 0000000000..226f715308 --- /dev/null +++ b/oak-lucene/src/test/java/org/apache/jackrabbit/oak/plugins/index/lucene/LuceneSecurityTest.java @@ -0,0 +1,40 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.jackrabbit.oak.plugins.index.lucene; + +import org.junit.Ignore; +import org.junit.Test; + +/** + * Tests for potential security issues + */ +public class LuceneSecurityTest { + + @Test + @Ignore("OAK-10713") + public void complexRegexp() throws Exception { + // test borrowed from: https://github.com/apache/lucene/issues/11537 + StringBuilder strBuilder = new StringBuilder(); + for (int i = 0; i < 50000; i++) { + strBuilder.append("a"); + } + + new org.apache.lucene.util.automaton.RegExp(strBuilder.toString()); + } +}