(maven-indexer) branch master updated: Limit boolean query nesting depth in search-api

[sl...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

slachiewicz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/maven-indexer.git


The following commit(s) were added to refs/heads/master by this push:
     new 0574a781 Limit boolean query nesting depth in search-api
0574a781 is described below

commit 0574a78170525ce7b4bbacf6aa60ecb59d7ca588
Author: Sylwester Lachiewicz <sl...@apache.org>
AuthorDate: Sat Sep 26 02:08:27 2026 +0200

    Limit boolean query nesting depth in search-api
---
 .../maven/search/api/request/BooleanQuery.java     | 17 ++++++
 .../maven/search/api/request/BooleanQueryTest.java | 62 ++++++++++++++++++++++
 2 files changed, 79 insertions(+)

diff --git a/search-api/src/main/java/org/apache/maven/search/api/request/BooleanQuery.java b/search-api/src/main/java/org/apache/maven/search/api/request/BooleanQuery.java
index f2038e1a..b0d6abd3 100644
--- a/search-api/src/main/java/org/apache/maven/search/api/request/BooleanQuery.java
+++ b/search-api/src/main/java/org/apache/maven/search/api/request/BooleanQuery.java
@@ -24,14 +24,31 @@ import static java.util.Objects.requireNonNull;
  * Boolean query.
  */
 public abstract class BooleanQuery extends Query {
+    /**
+     * The maximum nesting depth of a boolean query. Backends and {@link #toString()} walk the tree recursively; the
+     * value matches the default Lucene boolean clause limit.
+     */
+    public static final int MAX_DEPTH = 1024;
+
     protected final Query left;
 
     protected final Query right;
 
+    private final int depth;
+
     protected BooleanQuery(Query left, String op, Query right) {
         super(op);
         this.left = requireNonNull(left);
         this.right = requireNonNull(right);
+        this.depth = 1 + Math.max(depthOf(left), depthOf(right));
+        if (depth > MAX_DEPTH) {
+            throw new IllegalArgumentException(
+                    "boolean query nesting depth " + depth + " exceeds the maximum of " + MAX_DEPTH);
+        }
+    }
+
+    private static int depthOf(Query query) {
+        return query instanceof BooleanQuery ? ((BooleanQuery) query).depth : 0;
     }
 
     /**
diff --git a/search-api/src/test/java/org/apache/maven/search/api/request/BooleanQueryTest.java b/search-api/src/test/java/org/apache/maven/search/api/request/BooleanQueryTest.java
new file mode 100644
index 00000000..d1453db9
--- /dev/null
+++ b/search-api/src/test/java/org/apache/maven/search/api/request/BooleanQueryTest.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.maven.search.api.request;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+public class BooleanQueryTest {
+    private static Query[] terms(int count) {
+        Query[] terms = new Query[count];
+        for (int i = 0; i < count; i++) {
+            terms[i] = Query.query("t" + i);
+        }
+        return terms;
+    }
+
+    @Test
+    public void simpleAnd() {
+        BooleanQuery query = BooleanQuery.and(Query.query("left"), Query.query("right"));
+        assertEquals("left AND right", query.toString());
+    }
+
+    @Test
+    public void chainAtMaxDepthIsAcceptedAndConsumable() {
+        BooleanQuery query = BooleanQuery.and(Query.query("left"), terms(BooleanQuery.MAX_DEPTH));
+        // recursive consumption of a maximal legal chain must not overflow the stack
+        assertNotNull(query.toString());
+    }
+
+    @Test
+    public void chainBeyondMaxDepthIsRejected() {
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> BooleanQuery.and(Query.query("left"), terms(BooleanQuery.MAX_DEPTH + 1)));
+    }
+
+    @Test
+    public void nestedConstructionIsRejectedAtTheLimitToo() {
+        Query deep = BooleanQuery.and(Query.query("left"), terms(BooleanQuery.MAX_DEPTH));
+        // one more level on top of a maximal chain must fail, wherever it is nested
+        assertThrows(IllegalArgumentException.class, () -> BooleanQuery.and(deep, Query.query("right")));
+    }
+}