Don’t recurse on untrusted inputWe developed a simple CodeQL query to find denial-of-service (DoS) vulnerabilities in several high-profile Java projects.
