How to set default MaxDepth for AutoMapper in ABP 8? #10545

3 Answer(s)

• 

  0

  maliming created 6 months ago

  Support Team Fullstack Developer

  hi

  This vulnerability (GHSA-rvv3-g6hj-g44x) has been addressed in ABP 10.2 via [PR #25138](https://github.com/abpframework/abp/pull/25138), which sets a default MaxDepth = 64 for all AutoMapper maps.

  For ABP 8.x, you can apply the same mitigation without modifying framework code. Add the following to ConfigureServices in any of your modules:

  Configure<AbpAutoMapperOptions>(options =>
  {
      options.Configurators.Add(ctx =>
      {
          ctx.MapperConfiguration.Internal().ForAllMaps((typeMap, _) =>
          {
              if (typeMap.MaxDepth == 0)
              {
                  typeMap.MaxDepth = 64;
              }
          });
      });
  });
  

  This iterates over all registered maps and sets MaxDepth = 64 for any map that doesn't already have an explicit MaxDepth configured, which prevents the StackOverflow DoS caused by deeply nested object graphs.

  You'll need to add using AutoMapper.Internal; for the Internal() extension method.

  Thanks.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel

  1
• 

  0

  nhontran created 6 months ago

  Hi @maliming, thank you for the prompt response

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 6 months ago

  Support Team Fullstack Developer

  : )

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel