CVE-2021-45105-snippet-6.java

// found variable end marker 
if (nestedVarCount == 0) { 
    String varNameExpr = new String(chars, startPos + startMatchLen, pos - startPos - startMatchLen); 
    if (substitutionInVariablesEnabled) { 
        final StringBuilder bufName = new StringBuilder(varNameExpr); 
        substitute(event, bufName, 0, bufName.length()); 
        varNameExpr = bufName.toString(); 
    } 
    pos += endMatchLen; 
    final int endPos = pos;