aquasecurity / go-dep-parser

Dependency Parser for Multiple Programming Languages
MIT License
145 stars 109 forks source link

Infinite Recursion in `pom.xml` Looped Dependency #297

Closed xpcmdshell closed 7 months ago

xpcmdshell commented 8 months ago

There is currently an infinite recursion bug when parsing poms that have looped dependencies. This may occur in a scenario as such:

The parser will endlessly loop between B and A consuming memory until a stack overflow error occurs and the application crashes. Calling Parse on the pom.xml in this minimal reproducer project should demonstrate the behavior.

The parser likely needs a cycle check when parsing dependency to check if the dependency is already one of its ancestors.

Let me know if there's any additional context or reproduction help I can provide. Thanks!

DmitriyLewen commented 8 months ago

Hello @xpcmdshell Thanks for your report and example!

Do you have this case with real dependencies? I want to check the response of the mvn dependency:tree command.

Regards, Dmitriy

xpcmdshell commented 8 months ago

Hi Dimitriy,

This is a real example that should trigger the same bug: fili

Let me know if there's anything else I can provide, thanks!