spring version 5.3.25 no limit spring version 5.3.26 is MAX_REGEX_LENGTH = 256 spring version 5.3.29 is MAX_REGEX_LENGTH = 1000
public class OperatorMatches extends Operator {
private static final int PATTERN_ACCESS_THRESHOLD = 1000000;
/**
* Maximum number of characters permitted in a regular expression.
* @since 5.2.23
*/
private static final int MAX_REGEX_LENGTH = 1000;
the notes are wrong too.
Comment From: snicoll
The limit was introduced to address CVE-2023-20861 and further expanded based on community feedback see #30265.
the notes are wrong too.
What "notes"?
Comment From: Yannis-01
Thanks. I read the previous issue and I think the maximum value should be configurable. Otherwise, many systems will be affected.
Comment From: snicoll
So I don't know what notes are wrong but if you provide the information we can look at it.
Making the value configurable was discussed in the linked issue and rejected.