From e3a4d522b1a9f3a3d2081a30c49f4eb01497e745 Mon Sep 17 00:00:00 2001
From: maliming <malimings@gmail.com>
Date: Tue, 24 Mar 2026 09:57:30 +0800
Subject: [PATCH] Set default MaxDepth for all AutoMapper maps to mitigate
 GHSA-rvv3-g6hj-g44x

---
 .../Abp/AutoMapper/AbpAutoMapperModule.cs     |  8 +++
 .../AbpAutoMapperModule_MaxDepth_Tests.cs     | 65 +++++++++++++++++++
 2 files changed, 73 insertions(+)
 create mode 100644 framework/test/Volo.Abp.AutoMapper.Tests/Volo/Abp/AutoMapper/AbpAutoMapperModule_MaxDepth_Tests.cs

diff --git a/framework/src/Volo.Abp.AutoMapper/Volo/Abp/AutoMapper/AbpAutoMapperModule.cs b/framework/src/Volo.Abp.AutoMapper/Volo/Abp/AutoMapper/AbpAutoMapperModule.cs
index f1e266b745..fbc80d20b5 100644
--- a/framework/src/Volo.Abp.AutoMapper/Volo/Abp/AutoMapper/AbpAutoMapperModule.cs
+++ b/framework/src/Volo.Abp.AutoMapper/Volo/Abp/AutoMapper/AbpAutoMapperModule.cs
@@ -40,6 +40,14 @@ public class AbpAutoMapperModule : AbpModule
                     configurator(autoMapperConfigurationContext);
                 }
 
+                mapperConfigurationExpression.Internal().ForAllMaps((typeMap, _) =>
+                {
+                    if (typeMap.MaxDepth == 0)
+                    {
+                        typeMap.MaxDepth = 64;
+                    }
+                });
+
                 var mapperConfiguration = new MapperConfiguration(mapperConfigurationExpression);
 
                 foreach (var profileType in options.ValidatingProfiles)
diff --git a/framework/test/Volo.Abp.AutoMapper.Tests/Volo/Abp/AutoMapper/AbpAutoMapperModule_MaxDepth_Tests.cs b/framework/test/Volo.Abp.AutoMapper.Tests/Volo/Abp/AutoMapper/AbpAutoMapperModule_MaxDepth_Tests.cs
new file mode 100644
index 0000000000..ad24430cbd
--- /dev/null
+++ b/framework/test/Volo.Abp.AutoMapper.Tests/Volo/Abp/AutoMapper/AbpAutoMapperModule_MaxDepth_Tests.cs
@@ -0,0 +1,65 @@
+using AutoMapper;
+using AutoMapper.Internal;
+using Microsoft.Extensions.DependencyInjection;
+using Shouldly;
+using Volo.Abp.AutoMapper.SampleClasses;
+using Volo.Abp.Modularity;
+using Volo.Abp.ObjectExtending;
+using Volo.Abp.Testing;
+using Xunit;
+
+namespace Volo.Abp.AutoMapper;
+
+public class AbpAutoMapperModule_MaxDepth_Tests : AbpIntegratedTest<AutoMapperTestModule>
+{
+    private readonly IConfigurationProvider _configurationProvider;
+
+    public AbpAutoMapperModule_MaxDepth_Tests()
+    {
+        _configurationProvider = ServiceProvider.GetRequiredService<IConfigurationProvider>();
+    }
+
+    [Fact]
+    public void Should_Set_Default_MaxDepth_For_All_Maps()
+    {
+        var typeMap = _configurationProvider.Internal().FindTypeMapFor<MyEntity, MyEntityDto>();
+        typeMap.ShouldNotBeNull();
+        typeMap.MaxDepth.ShouldBe(64);
+    }
+}
+
+public class AbpAutoMapperModule_CustomMaxDepth_Tests : AbpIntegratedTest<AbpAutoMapperModule_CustomMaxDepth_Tests.TestModule>
+{
+    private readonly IConfigurationProvider _configurationProvider;
+
+    public AbpAutoMapperModule_CustomMaxDepth_Tests()
+    {
+        _configurationProvider = ServiceProvider.GetRequiredService<IConfigurationProvider>();
+    }
+
+    [Fact]
+    public void Should_Not_Override_Custom_MaxDepth()
+    {
+        var typeMap = _configurationProvider.Internal().FindTypeMapFor<MyEntity, MyEntityDto>();
+        typeMap.ShouldNotBeNull();
+        typeMap.MaxDepth.ShouldBe(10);
+    }
+
+    [DependsOn(
+        typeof(AbpAutoMapperModule),
+        typeof(AbpObjectExtendingTestModule)
+    )]
+    public class TestModule : AbpModule
+    {
+        public override void ConfigureServices(ServiceConfigurationContext context)
+        {
+            Configure<AbpAutoMapperOptions>(options =>
+            {
+                options.Configurators.Add(ctx =>
+                {
+                    ctx.MapperConfiguration.CreateMap<MyEntity, MyEntityDto>().MaxDepth(10);
+                });
+            });
+        }
+    }
+}