CVE-2021-45105-snippet-5.java

// resolve the variable 
String varValue = resolveVariable(event, varName, buf, startPos, endPos); 
if (varValue == null) { 
    varValue = varDefaultValue; 
} 
if (varValue != null) { 
    // recursive replace 
    final int varLen = varValue.length(); 
    buf.replace(startPos, endPos, varValue); 
    altered = true; 
    int change = substitute(event, buf, startPos, varLen, priorVariables); 
    change = change + (varLen - (endPos - startPos)); 
    pos += change; 
    bufEnd += change; 
    lengthChange += change; 
    chars = getChars(buf); // in case buffer was altered 
}