DATACMNS-1285 - PropertyPath now limits the depth of its parsing to 1000 segments.

src/main/java/org/springframework/data/mapping/PropertyPath.java

@@ -46,6 +46,8 @@ import org.springframework.util.StringUtils;
 @EqualsAndHashCode
 public class PropertyPath implements Streamable<PropertyPath> {
 
+	private static final String PARSE_DEPTH_EXCEEDED = "Trying to parse a path with depth greater than 1000! This has been disabled for security reasons to prevent parsing overflows.";
+
 	private static final String DELIMITERS = "_\\.";
 	private static final String ALL_UPPERCASE = "[A-Z0-9._$]+";
 	private static final Pattern SPLITTER = Pattern.compile("(?:[%s]?([%s]*?[^%s]+))".replaceAll("%s", DELIMITERS));
@@ -342,6 +344,10 @@ public class PropertyPath implements Streamable<PropertyPath> {
 	 */
 	private static PropertyPath create(String source, TypeInformation<?> type, String addTail, List<PropertyPath> base) {
 
+		if (base.size() > 1000) {
+			throw new IllegalArgumentException(PARSE_DEPTH_EXCEEDED);
+		}
+
 		PropertyReferenceException exception = null;
 		PropertyPath current = null;
 

src/test/java/org/springframework/data/mapping/PropertyPathUnitTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2011-2017 the original author or authors.
+ * Copyright 2011-2018 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -350,6 +350,23 @@ public class PropertyPathUnitTests {
 		assertThat(from("userName", Foo.class)).isSameAs(from("userName", Foo.class));
 	}
 
+	@Test // DATACMNS-1285
+	public void rejectsTooLongPath() {
+
+		String source = "foo.bar";
+
+		for (int i = 0; i < 9; i++) {
+			source = source + "." + source;
+		}
+
+		assertThat(source.split("\\.").length).isGreaterThan(1000);
+
+		final String path = source;
+
+		assertThatExceptionOfType(IllegalArgumentException.class) //
+				.isThrownBy(() -> PropertyPath.from(path, Left.class));
+	}
+
 	private class Foo {
 
 		String userName;
@@ -384,4 +401,14 @@ public class PropertyPathUnitTests {
 		private FooBar user;
 		private Foo _foo;
 	}
+
+	// DATACMNS-1285
+
+	private class Left {
+		Right foo;
+	}
+
+	private class Right {
+		Left bar;
+	}
 }