DefaultModelBuilder: getEnhancedProperties StackOverflow recursion
Found in: maven-4.0.x branch
File: impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java (lines 728-748)
Severity: Medium
Description
getEnhancedProperties calls derive(Sources.buildSource(rootModelPath)).readFileModel(activeModelReads) recursively. The activeModelReads guard only checks normalized path, but if the root model's project directory and rootDirectory differ in a way that causes locateExistingPom to return a path whose normalized form is NOT in activeModelReads but still eventually leads back to the same model, a StackOverflowError can occur.
The comment at lines 736-737 explicitly acknowledges this: "to prevent StackOverflowError when a project has an internal parent in a subdirectory with CI-friendly ${revision} and a .mvn/ root marker (GH-12301)".
This can crash Maven entirely in complex multi-module projects with .mvn/ root markers and CI-friendly versions.
DefaultModelBuilder: getEnhancedProperties StackOverflow recursion
Found in: maven-4.0.x branch
File:
impl/maven-impl/src/main/java/org/apache/maven/impl/model/DefaultModelBuilder.java(lines 728-748)Severity: Medium
Description
getEnhancedPropertiescallsderive(Sources.buildSource(rootModelPath)).readFileModel(activeModelReads)recursively. TheactiveModelReadsguard only checks normalized path, but if the root model's project directory androotDirectorydiffer in a way that causeslocateExistingPomto return a path whose normalized form is NOT inactiveModelReadsbut still eventually leads back to the same model, a StackOverflowError can occur.The comment at lines 736-737 explicitly acknowledges this: "to prevent StackOverflowError when a project has an internal parent in a subdirectory with CI-friendly ${revision} and a .mvn/ root marker (GH-12301)".
This can crash Maven entirely in complex multi-module projects with
.mvn/root markers and CI-friendly versions.