apache / apache/maven-dependency-tree

StackOverflowError from recursive dependency graph build/traversal (deep chains)

Open
#130 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
27
Forks
31
Avg merge
5h 53m
Merged PRs (30d)
1

Description

## Summary
The dependency graph is built and traversed recursively, so a deeply nested dependency chain can crash the JVM with a `StackOverflowError` instead of failing gracefully.

## Affected code
- `DefaultDependencyNode.accept(...)` recurses over children: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyNode.java:104-114`
- `DefaultDependencyCollectorBuilder.buildDependencyNode(...)` recurses per node: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyCollectorBuilder.java:225-231`
- `DefaultDependencyGraphBuilder.buildDependencyNode(...)`: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyGraphBuilder.java:153-158`
- `BuildingDependencyNodeVisitor.endVisit(...)` re-applies the visitor via `rootNode.accept(...)`: `src/main/java/org/apache/maven/shared/dependency/graph/traversal/BuildingDependencyNodeVisitor.java:111-113`

## Impact
Because this library backs `mvn dependency:tree` / `dependency:analyze`, a crafted or pathological deep chain (thousands of levels) will overflow the stack. This is an availability / denial-of-service concern when running against untrusted or generated POMs, and even legitimate large projects can hit it.

## Suggested fix
Rewrite the traversal iteratively (explicit stack), or at least convert the deepest recursion (`accept`) to an iterative pre-order/post-order walk.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with DefaultDependencyNode.accept(...) at src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyNode.java:104-114, then trace the recursive build methods and BuildingDependencyNodeVisitor.endVisit(...) listed in the issue. Compare the traversal and construction paths, and verify that a dependency chain thousands of levels deep no longer causes StackOverflowError and still completes graph traversal.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.