From 0c564f75c9581060c4175af11daccfce52abe591 Mon Sep 17 00:00:00 2001
From: sahvx655-wq <sahvx655@gmail.com>
Date: Sat, 30 May 2026 15:41:37 +0530
Subject: [PATCH] reject malformed map entries in collections type converter

---
 .../DefaultCollectionsTypeConverterFactory.java       | 11 ++++++++---
 .../java/com/netflix/archaius/DefaultDecoderTest.java |  5 +++++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/archaius2-core/src/main/java/com/netflix/archaius/converters/DefaultCollectionsTypeConverterFactory.java b/archaius2-core/src/main/java/com/netflix/archaius/converters/DefaultCollectionsTypeConverterFactory.java
index 84a78f1f..ab65e8ea 100644
--- a/archaius2-core/src/main/java/com/netflix/archaius/converters/DefaultCollectionsTypeConverterFactory.java
+++ b/archaius2-core/src/main/java/com/netflix/archaius/converters/DefaultCollectionsTypeConverterFactory.java
@@ -2,6 +2,7 @@
 
 import com.netflix.archaius.api.TypeConverter;
 import com.netflix.archaius.exceptions.ConverterNotFoundException;
+import com.netflix.archaius.exceptions.ParseException;
 
 import java.lang.reflect.ParameterizedType;
 import java.lang.reflect.Type;
@@ -106,9 +107,13 @@ private static <K, V> TypeConverter<Map<K, V>> createMapTypeConverter(final Type
                     .stream(s.split("\\s*,\\s*"))
                     .filter(pair -> !pair.isEmpty())
                     .map(pair -> pair.split("\\s*=\\s*"))
-                    .forEach(kv -> result.put(
-                            keyConverter.convert(kv[0]),
-                            valueConverter.convert(kv[1])));
+                    .forEach(kv -> {
+                        if (kv.length != 2) {
+                            throw new ParseException("Error parsing map entry '" + String.join("=", kv) + "'",
+                                    new Exception("Expected 'key=value'"));
+                        }
+                        result.put(keyConverter.convert(kv[0]), valueConverter.convert(kv[1]));
+                    });
             return Collections.unmodifiableMap(result);
         };
     }
diff --git a/archaius2-core/src/test/java/com/netflix/archaius/DefaultDecoderTest.java b/archaius2-core/src/test/java/com/netflix/archaius/DefaultDecoderTest.java
index 625beda3..15153edf 100644
--- a/archaius2-core/src/test/java/com/netflix/archaius/DefaultDecoderTest.java
+++ b/archaius2-core/src/test/java/com/netflix/archaius/DefaultDecoderTest.java
@@ -51,9 +51,12 @@
 import org.apache.commons.codec.binary.Hex;
 import org.junit.jupiter.api.Test;
 
+import com.netflix.archaius.exceptions.ParseException;
+
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 
@@ -132,6 +135,8 @@ public void testCollections() {
         assertEquals(Collections.singleton(2L), decoder.decode(setOfLongType, "2,2,2,2"));
         assertEquals(Collections.emptyMap(), decoder.decode(mapofStringToIntegerType, ""));
         assertEquals(Collections.singletonMap("key", 12345), decoder.decode(mapofStringToIntegerType, "key=12345"));
+        // A map entry without a '=' separator is rejected with a clear error instead of crashing
+        assertThrows(ParseException.class, () -> decoder.decode(mapofStringToIntegerType, "key=12345,bogus"));
     }
 
     @Test