Add max depth in resolving a pattern to avoid OOM

Signed-off-by: Sandesh Kumar <[email protected]>
sandeshkr419 · Jun 17, 2024 · 20eff06 · 20eff06
1 parent 90f8a44
commit 20eff06
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/libs/grok/src/main/java/org/opensearch/grok/Grok.java b/libs/grok/src/main/java/org/opensearch/grok/Grok.java
@@ -90,6 +90,7 @@ public final class Grok {
         UTF8Encoding.INSTANCE,
         Syntax.DEFAULT
     );
+    private static final int MAX_PATTERN_DEPTH_SIZE = 1_000;
 
     private static final int MAX_TO_REGEX_ITERATIONS = 100_000; // sanity limit
 
@@ -222,6 +223,10 @@ private void validatePatternBank(String initialPatternName) {
                 pathMap.remove(patternName);
                 queue.pop();
             }
+
+            if (queue.size() > MAX_PATTERN_DEPTH_SIZE) {
+                throw new IllegalArgumentException("Pattern references exceeded maximum depth of " + MAX_PATTERN_DEPTH_SIZE);
+            }
         }
     }
 

diff --git a/libs/grok/src/test/java/org/opensearch/grok/GrokTests.java b/libs/grok/src/test/java/org/opensearch/grok/GrokTests.java
@@ -377,6 +377,16 @@ public void testCircularReference() {
             "circular reference in pattern [NAME5][!!!%{NAME1}!!!] back to pattern [NAME1] " + "via patterns [NAME1=>NAME2=>NAME3=>NAME4]",
             e.getMessage()
         );
+
+        e = expectThrows(IllegalArgumentException.class, () -> {
+            Map<String, String> bank = new TreeMap<>();
+            for (int i = 1; i <= 1001; i++) {
+                bank.put("NAME" + i, "!!!%{NAME" + (i + 1) + "}!!!");
+            }
+            String pattern = "%{NAME1}";
+            new Grok(bank, pattern, false, logger::warn);
+        });
+        assertEquals("Pattern references exceeded maximum depth of 1000", e.getMessage());
     }
 
     public void testMalformedPattern() {