CVE-2019-1003011: Jenkins Token Macro Plugin's recursive token expansion results in information disclosure and DoS

The vulnerability stemmed from recursive token expansion without depth control. The Parser.processToken() method handled token replacement recursively but lacked a recursion limit prior to the patch, enabling infinite recursion. Additionally, AbstractChangesSinceMacro and ChangesSinceLastBuildMacro's evaluate() methods processed user-controllable format/path parameters through TokenMacro.expandAll() without limiting recursion depth, creating secondary expansion vectors. The commit introduced a MAX_RECURSION_LEVEL check in Parser and removed nested expansion capabilities from these macros, confirming their role in the vulnerability.