[AAP] Cap recursion depth in ObjectExtractor's list/dictionary paths

tracer/src/Datadog.Trace/AppSec/ObjectExtractor.cs

@@ -569,6 +569,12 @@ private static bool IsCollectionType(Type type)
                 return EmptyDictionary;
             }
 
+            depth++;
+            if (depth >= WafConstants.MaxContainerDepth)
+            {
+                return EmptyDictionary;
+            }
+
             var gtkvp = typeof(KeyValuePair<,>);
             var tkvp = gtkvp.MakeGenericType(dictType.GetGenericArguments());
             var keyProp = tkvp.GetProperty("Key");
@@ -603,7 +609,7 @@ private static bool IsCollectionType(Type type)
                         }
                         else
                         {
-                            var extractedvalue = ExtractType(dictValue.GetType(), dictValue, depth + 1, visited, extractorCache, createExtractors, useSimpleDictionaryFormat);
+                            var extractedvalue = ExtractType(dictValue.GetType(), dictValue, depth, visited, extractorCache, createExtractors, useSimpleDictionaryFormat);
                             items.Add(dictKey, extractedvalue);
                         }
 
@@ -635,6 +641,14 @@ private static bool IsCollectionType(Type type)
                 return [];
             }
 
+            // Mirrors ExtractProperties: once the incremented depth reaches the limit, stop recursing
+            // into children instead of descending unbounded (which previously risked a stack overflow).
+            depth++;
+            if (depth >= WafConstants.MaxContainerDepth)
+            {
+                return [];
+            }
+
             var gtkvp = typeof(KeyValuePair<,>);
             var tkvp = gtkvp.MakeGenericType(dictType.GetGenericArguments());
             var keyProp = tkvp.GetProperty("Key");
@@ -654,8 +668,8 @@ private static bool IsCollectionType(Type type)
 
                     var pair = new Dictionary<string, object?>(2)
                     {
-                        ["Key"] = dictKey is null ? null : ExtractType(dictKey.GetType(), dictKey, depth + 1, visited, extractorCache, createExtractors, useSimpleDictionaryFormat),
-                        ["Value"] = dictValue is null ? null : ExtractType(dictValue.GetType(), dictValue, depth + 1, visited, extractorCache, createExtractors, useSimpleDictionaryFormat),
+                        ["Key"] = dictKey is null ? null : ExtractType(dictKey.GetType(), dictKey, depth, visited, extractorCache, createExtractors, useSimpleDictionaryFormat),
+                        ["Value"] = dictValue is null ? null : ExtractType(dictValue.GetType(), dictValue, depth, visited, extractorCache, createExtractors, useSimpleDictionaryFormat),
                     };
                     items.Add(pair);
 
@@ -682,9 +696,14 @@ private static object ExtractNonGenericDictionary(
         {
             var capacity = Math.Min(WafConstants.MaxContainerSize, source.Count);
 
+            // Mirrors ExtractProperties: once the incremented depth reaches the limit, stop recursing
+            // into children instead of descending unbounded (which previously risked a stack overflow).
+            depth++;
+            var depthExceeded = depth >= WafConstants.MaxContainerDepth;
+
             if (useSimpleDictionaryFormat)
             {
-                if (!visited.Add(source))
+                if (!visited.Add(source) || depthExceeded)
                 {
                     return EmptyDictionary;
                 }
@@ -700,7 +719,7 @@ private static object ExtractNonGenericDictionary(
                         continue;
                     }
 
-                    map[key] = entry.Value is null ? null : ExtractType(entry.Value.GetType(), entry.Value, depth + 1, visited, extractorCache, createExtractors, useSimpleDictionaryFormat);
+                    map[key] = entry.Value is null ? null : ExtractType(entry.Value.GetType(), entry.Value, depth, visited, extractorCache, createExtractors, useSimpleDictionaryFormat);
                     if (map.Count >= WafConstants.MaxContainerSize)
                     {
                         break;
@@ -710,7 +729,7 @@ private static object ExtractNonGenericDictionary(
                 return map;
             }
 
-            if (!visited.Add(source))
+            if (!visited.Add(source) || depthExceeded)
             {
                 return new List<object?>();
             }
@@ -722,8 +741,8 @@ private static object ExtractNonGenericDictionary(
                 var entry = enumerator.Entry;
                 items.Add(new Dictionary<string, object?>(2)
                 {
-                    ["Key"] = entry.Key is null ? null : ExtractType(entry.Key.GetType(), entry.Key, depth + 1, visited, extractorCache, createExtractors, useSimpleDictionaryFormat),
-                    ["Value"] = entry.Value is null ? null : ExtractType(entry.Value.GetType(), entry.Value, depth + 1, visited, extractorCache, createExtractors, useSimpleDictionaryFormat),
+                    ["Key"] = entry.Key is null ? null : ExtractType(entry.Key.GetType(), entry.Key, depth, visited, extractorCache, createExtractors, useSimpleDictionaryFormat),
+                    ["Value"] = entry.Value is null ? null : ExtractType(entry.Value.GetType(), entry.Value, depth, visited, extractorCache, createExtractors, useSimpleDictionaryFormat),
                 });
                 if (items.Count >= WafConstants.MaxContainerSize)
                 {
@@ -754,6 +773,12 @@ private static object ExtractNonGenericDictionary(
                 return [];
             }
 
+            depth++;
+            if (depth >= WafConstants.MaxContainerDepth)
+            {
+                return [];
+            }
+
             // Use ICollection for pre-sizing when available. Some types (e.g. HashSet<T>) implement
             // ICollection<T> but not the non-generic ICollection, so fall back to default capacity.
             var items = value is ICollection sourceColl
@@ -768,7 +793,7 @@ private static object ExtractNonGenericDictionary(
                 }
                 else
                 {
-                    var extractedvalue = ExtractType(item.GetType(), item, depth + 1, visited, extractorCache, createExtractors, useSimpleDictionaryFormat);
+                    var extractedvalue = ExtractType(item.GetType(), item, depth, visited, extractorCache, createExtractors, useSimpleDictionaryFormat);
                     items.Add(extractedvalue);
                 }
 

tracer/test/Datadog.Trace.Security.Unit.Tests/ObjectExtractorTests.cs

@@ -915,6 +915,31 @@ public void TestSelfReferentialCollectionDoesNotStackOverflow()
             act.Should().NotThrow();
         }
 
+        [Fact]
+        public void TestNestedListRespectsMaxContainerDepth()
+        {
+            object nested = "leaf";
+            for (var i = 0; i < WafConstants.MaxContainerDepth + 5; i++)
+            {
+                nested = new List<object> { nested };
+            }
+
+            var result = ObjectExtractor.Extract(nested) as List<object>;
+
+            var current = result;
+            for (var i = 0; i < WafConstants.MaxContainerDepth - 1; i++)
+            {
+                current.Should().NotBeNull();
+                current.Should().HaveCount(1);
+                current = current![0] as List<object>;
+            }
+
+            // The list at the depth limit must be cut off empty, matching ExtractProperties' behavior
+            // for objects at the same depth (see TestNestedObjectsAboveLimit).
+            current.Should().NotBeNull();
+            current.Should().BeEmpty();
+        }
+
 #if NETFRAMEWORK
         [Fact]
         public void TestDateTimeOffsetExtractedAsObject_DataContractPath()