apache / apache/maven-dependency-tree
StackOverflowError from recursive dependency graph build/traversal (deep chains)
- Dominant language
- Java
- Stars
- 27
- Forks
- 31
- Avg merge
- 5h 53m
- Merged PRs (30d)
- 1
Description
## Summary
The dependency graph is built and traversed recursively, so a deeply nested dependency chain can crash the JVM with a `StackOverflowError` instead of failing gracefully.
## Affected code
- `DefaultDependencyNode.accept(...)` recurses over children: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyNode.java:104-114`
- `DefaultDependencyCollectorBuilder.buildDependencyNode(...)` recurses per node: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyCollectorBuilder.java:225-231`
- `DefaultDependencyGraphBuilder.buildDependencyNode(...)`: `src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyGraphBuilder.java:153-158`
- `BuildingDependencyNodeVisitor.endVisit(...)` re-applies the visitor via `rootNode.accept(...)`: `src/main/java/org/apache/maven/shared/dependency/graph/traversal/BuildingDependencyNodeVisitor.java:111-113`
## Impact
Because this library backs `mvn dependency:tree` / `dependency:analyze`, a crafted or pathological deep chain (thousands of levels) will overflow the stack. This is an availability / denial-of-service concern when running against untrusted or generated POMs, and even legitimate large projects can hit it.
## Suggested fix
Rewrite the traversal iteratively (explicit stack), or at least convert the deepest recursion (`accept`) to an iterative pre-order/post-order walk.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with DefaultDependencyNode.accept(...) at src/main/java/org/apache/maven/shared/dependency/graph/internal/DefaultDependencyNode.java:104-114, then trace the recursive build methods and BuildingDependencyNodeVisitor.endVisit(...) listed in the issue. Compare the traversal and construction paths, and verify that a dependency chain thousands of levels deep no longer causes StackOverflowError and still completes graph traversal.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100