elharo opened a new issue, #130: URL: https://github.com/apache/maven-dependency-tree/issues/130
## Summary The dependency graph is built and traversed recursively, so a deeply nested dependency chain can crash the JVM with a `StackOverflowError` instead of failing gracefully. ## Affected code - `DefaultDependencyNode.accept(...)` recurses over children: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyNode.java:104-114` - `DefaultDependencyCollectorBuilder.buildDependencyNode(...)` recurses per node: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyCollectorBuilder.java:225-231` - `DefaultDependencyGraphBuilder.buildDependencyNode(...)`: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyGraphBuilder.java:153-158` - `BuildingDependencyNodeVisitor.endVisit(...)` re-applies the visitor via `rootNode.accept(...)`: `src/main/java/org/apache/maven/shared/dependency/graph/traversal/BuildingDependencyNodeVisitor.java:111-113` ## Impact Because this library backs `mvn dependency:tree` / `dependency:analyze`, a crafted or pathological deep chain (thousands of levels) will overflow the stack. This is an availability / denial-of-service concern when running against untrusted or generated POMs, and even legitimate large projects can hit it. ## Suggested fix Rewrite the traversal iteratively (explicit stack), or at least convert the deepest recursion (`accept`) to an iterative pre-order/post-order walk. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
