From 4f3432c1c5d1ea8249149e3a86847ec40c2cad93 Mon Sep 17 00:00:00 2001
From: Tugamer89 <61603718+Tugamer89@users.noreply.github.com>
Date: Tue, 16 Jun 2026 04:38:06 +0000
Subject: [PATCH] fix(security): resolve DoS vulnerability in automaton builder

- Added MAX_STATES constant (10000) to AbstractAutomatonBuilder.
- Added check in addState to throw IllegalStateException if limit exceeded.
- Prevents memory exhaustion attacks via excessive state creation.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
---
 .../org/eu/autogex/core/AbstractAutomatonBuilder.java    | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java b/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java
index baa8c4d6..3fdc49e9 100644
--- a/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java
+++ b/src/main/java/org/eu/autogex/core/AbstractAutomatonBuilder.java
@@ -13,6 +13,11 @@
 public abstract class AbstractAutomatonBuilder<
         B extends AbstractAutomatonBuilder<B, A>, A extends Automaton> {
 
+    /**
+     * Maximum allowed states in a manually constructed automaton to prevent state explosion (DoS).
+     */
+    protected static final int MAX_STATES = 10000;
+
     protected final Map<String, State> states = new HashMap<>();
     protected final Set<State> finalStates = new HashSet<>();
     protected State initialState;
@@ -39,6 +44,10 @@ protected AbstractAutomatonBuilder() {
      * @return The current builder instance.
      */
     public B addState(String name, boolean isFinal) {
+        if (states.size() >= MAX_STATES) {
+            throw new IllegalStateException(
+                    "Automaton state limit exceeded (Security: DoS prevention).");
+        }
         State state = new State(name, isFinal);
         states.put(name, state);
         if (isFinal) {