Set default MaxDepth for all AutoMapper maps to mitigate GHSA-rvv3-g6hj-g44x

framework/src/Volo.Abp.AutoMapper/Volo/Abp/AutoMapper/AbpAutoMapperModule.cs

@@ -40,6 +40,14 @@ public class AbpAutoMapperModule : AbpModule
                     configurator(autoMapperConfigurationContext);
                 }
 
+                mapperConfigurationExpression.Internal().ForAllMaps((typeMap, _) =>
+                {
+                    if (typeMap.MaxDepth == 0)
+                    {
+                        typeMap.MaxDepth = 64;
+                    }
+                });
+
                 var mapperConfiguration = new MapperConfiguration(mapperConfigurationExpression);
 
                 foreach (var profileType in options.ValidatingProfiles)

framework/test/Volo.Abp.AutoMapper.Tests/Volo/Abp/AutoMapper/AbpAutoMapperModule_MaxDepth_Tests.cs

@@ -0,0 +1,65 @@
+using AutoMapper;
+using AutoMapper.Internal;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+using Volo.Abp.AutoMapper.SampleClasses;
+using Volo.Abp.Modularity;
+using Volo.Abp.ObjectExtending;
+using Volo.Abp.Testing;
+using Xunit;
+
+namespace Volo.Abp.AutoMapper;
+
+public class AbpAutoMapperModule_MaxDepth_Tests : AbpIntegratedTest<AutoMapperTestModule>
+{
+    private readonly IConfigurationProvider _configurationProvider;
+
+    public AbpAutoMapperModule_MaxDepth_Tests()
+    {
+        _configurationProvider = ServiceProvider.GetRequiredService<IConfigurationProvider>();
+    }
+
+    [Fact]
+    public void Should_Set_Default_MaxDepth_For_All_Maps()
+    {
+        var typeMap = _configurationProvider.Internal().FindTypeMapFor<MyEntity, MyEntityDto>();
+        typeMap.ShouldNotBeNull();
+        typeMap.MaxDepth.ShouldBe(64);
+    }
+}
+
+public class AbpAutoMapperModule_CustomMaxDepth_Tests : AbpIntegratedTest<AbpAutoMapperModule_CustomMaxDepth_Tests.TestModule>
+{
+    private readonly IConfigurationProvider _configurationProvider;
+
+    public AbpAutoMapperModule_CustomMaxDepth_Tests()
+    {
+        _configurationProvider = ServiceProvider.GetRequiredService<IConfigurationProvider>();
+    }
+
+    [Fact]
+    public void Should_Not_Override_Custom_MaxDepth()
+    {
+        var typeMap = _configurationProvider.Internal().FindTypeMapFor<MyEntity, MyEntityDto>();
+        typeMap.ShouldNotBeNull();
+        typeMap.MaxDepth.ShouldBe(10);
+    }
+
+    [DependsOn(
+        typeof(AbpAutoMapperModule),
+        typeof(AbpObjectExtendingTestModule)
+    )]
+    public class TestModule : AbpModule
+    {
+        public override void ConfigureServices(ServiceConfigurationContext context)
+        {
+            Configure<AbpAutoMapperOptions>(options =>
+            {
+                options.Configurators.Add(ctx =>
+                {
+                    ctx.MapperConfiguration.CreateMap<MyEntity, MyEntityDto>().MaxDepth(10);
+                });
+            });
+        }
+    }
+}