Add default for MaxExpressions

CHANGELOG.md

@@ -3,7 +3,8 @@
 ### Improvements
 
 ### Changes
+- Adds a default of 2 million for max evaluated expressions.
 
 ### Fixed
 
-### Security
+### Security

bexpr.go

@@ -32,13 +32,17 @@ type Evaluator struct {
 
 // CreateEvaluator is used to create and configure a new Evaluator, the expression
 // will be used by the evaluator when evaluating against any supplied datum.
+// By default the evaluator will error after 2 million expressions.
 // The following Option types are supported:
 // WithHookFn, WithMaxExpressions, WithTagName, WithUnknownValue.
 func CreateEvaluator(expression string, opts ...Option) (*Evaluator, error) {
 	parsedOpts := getOpts(opts...)
 	var parserOpts []grammar.Option
 	if parsedOpts.withMaxExpressions != 0 {
 		parserOpts = append(parserOpts, grammar.MaxExpressions(parsedOpts.withMaxExpressions))
+	} else {
+		// Use sane default as large expressions consume significant memory
+		parserOpts = append(parserOpts, grammar.MaxExpressions(2000000))
 	}
 
 	ast, err := grammar.Parse("", []byte(expression), parserOpts...)

bexpr_test.go

@@ -21,18 +21,23 @@ func TestCreateEvaluator(t *testing.T) {
 		"basic": {
 			expression: "foo == 3",
 		},
+		"default max expressions": {
+			expression: "((((((((foo == 1))))))))",
+			// typo in pigeon code-gen
+			err: "max number of expresssions parsed",
+		},
 	}
 
 	for name, tcase := range tests {
-		name := name
-		tcase := tcase
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
-
 			expr, err := CreateEvaluator(tcase.expression)
 			if tcase.err == "" {
 				require.NoError(t, err)
 				require.NotNil(t, expr)
+			} else {
+				require.Error(t, err)
+				require.Contains(t, err.Error(), tcase.err)
 			}
 		})
 	}