Reject out-of-range color components in ColorConverter

[rootvector2]

ColorConverter.parseToStringColor already rejects color components above 255, but the JAVA_COLOR_PATTERN label prefix [A-Za-z\d._]+ includes \d, so for a bare triple whose first component has four or more digits the greedy label swallows the leading digit and the first capture group only sees the trailing one to three digits. 1234,5,6 is parsed as Color(4,5,6), and 1000,0,0 / 2550,0,0 as black, so a malformed out-of-range value is accepted as a different in-range color instead of ever reaching the > 255 check. Binding the optional class-name label to its opening [ ((?:[A-Za-z\d._]*\[)?) stops it absorbing digits from the numeric groups; every string Color#toString() emits still parses the same, including class names that contain digits. Found while auditing the converters that parse untrusted strings.

• Read the contribution guidelines for this project.
• Read the ASF Generative Tooling Guidance if you use Artificial Intelligence (AI).
• I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute?
• Run a successful build using the default Maven goal with mvn; that's mvn on the command line by itself.
• Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
• Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
• Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.

[Copilot]

Pull request overview

This pull request tightens ColorConverter’s parsing of Java Color#toString()-style strings to ensure malformed out-of-range numeric components can’t be accidentally accepted due to regex prefix greediness.

Changes:

• Updates JAVA_COLOR_PATTERN to bind the optional class-name label to the opening [ so digits can’t be consumed from the first numeric component.
• Adds unit tests asserting that out-of-range component inputs like 1234,5,6 are rejected with a ConversionException.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/main/java/org/apache/commons/beanutils2/converters/ColorConverter.java	Adjusts the JAVA_COLOR_PATTERN so malformed numeric triples can’t be mis-parsed into in-range colors.
src/test/java/org/apache/commons/beanutils2/converters/ColorConverterTest.java	Adds regression tests covering previously-accepted out-of-range inputs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[garydgregory]

TY @rootvector2 , merged 🚀 Please port to 1.X with the additional assertions in the new test.

[rootvector2]

checked the 1.X branch and it has no ColorConverter (no java.awt.Color handling at all, the converter only came in with 2.x via #47), so there's nothing to port there. thanks for merging.