Prevent circular ACL parent relationships

Signed-off-by: 98001yash <yashchauhan.gaya@gmail.com>

Author: yashdotdev13

acl/src/main/java/org/springframework/security/acls/domain/AclImpl.java

@@ -247,7 +247,11 @@ public void setOwner(Sid newOwner) {
 	@Override
 	public void setParent(@Nullable Acl newParent) {
 		this.aclAuthorizationStrategy.securityCheck(this, AclAuthorizationStrategy.CHANGE_GENERAL);
-		Assert.isTrue(newParent == null || !newParent.equals(this), "Cannot be the parent of yourself");
+		Acl parent = newParent;
+		while (parent != null) {
+			Assert.isTrue(parent != this, "Cannot create a circular parent relationship");
+			parent = parent.getParentAcl();
+		}
 		this.parentAcl = newParent;
 	}
 

acl/src/test/java/org/springframework/security/acls/domain/AclImplTests.java

@@ -391,6 +391,33 @@ public void gettersAndSettersAreConsistent() {
 		assertThat(new PrincipalSid("ben")).isEqualTo(acl.getOwner());
 	}
 
+	@Test
+	public void setParentRejectsAncestor() {
+		MutableAcl parentAcl = new AclImpl(new ObjectIdentityImpl(TARGET_CLASS, 101), 101,
+				this.authzStrategy, this.pgs, null, null, true, new PrincipalSid("joe"));
+		MutableAcl childAcl = new AclImpl(new ObjectIdentityImpl(TARGET_CLASS, 102), 102,
+				this.authzStrategy, this.pgs, null, null, true, new PrincipalSid("joe"));
+
+		childAcl.setParent(parentAcl);
+
+		assertThatIllegalArgumentException().isThrownBy(() -> parentAcl.setParent(childAcl));
+	}
+
+	@Test
+	public void setParentRejectsIndirectAncestor() {
+		MutableAcl grandParentAcl = new AclImpl(new ObjectIdentityImpl(TARGET_CLASS, 101), 101,
+				this.authzStrategy, this.pgs, null, null, true, new PrincipalSid("joe"));
+		MutableAcl parentAcl = new AclImpl(new ObjectIdentityImpl(TARGET_CLASS, 102), 102,
+				this.authzStrategy, this.pgs, null, null, true, new PrincipalSid("joe"));
+		MutableAcl childAcl = new AclImpl(new ObjectIdentityImpl(TARGET_CLASS, 103), 103,
+				this.authzStrategy, this.pgs, null, null, true, new PrincipalSid("joe"));
+
+		parentAcl.setParent(grandParentAcl);
+		childAcl.setParent(parentAcl);
+
+		assertThatIllegalArgumentException().isThrownBy(() -> grandParentAcl.setParent(childAcl));
+	}
+
 	@Test
 	public void isSidLoadedBehavesAsExpected() {
 		List<Sid> loadedSids = Arrays.asList(new PrincipalSid("ben"), new GrantedAuthoritySid("ROLE_IGNORED"));