Skip to content

Add recursion guard to traceSymbol in Java and Python detection engines #400

@Ayush-Patel-56

Description

@Ayush-Patel-56

Summary

traceSymbol in both JavaDetectionEngine and PythonDetectionEngine follows variable initializer chains recursively but has no cycle detection. A self-referential or mutually recursive assignment (e.g. x = x) would cause a StackOverflowError at analysis time.

Steps to reproduce

// hypothetical pathological input
SomeType x = x; // self-referential

Expected behavior

Detection gracefully stops at the cycle and returns the last seen symbol.

Suggested fix

Track visited symbols in a Set and return early if a symbol has already been seen during the current trace.

private Symbol traceSymbol(Symbol symbol, Set<Symbol> visited) {
    if (!visited.add(symbol)) return symbol;
    // ... existing logic
}

Context

Identified during review of PR #390. The fix for intermediary variable detection intentionally left this out to keep the scope minimal. Tracked here as a follow-up.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions