Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add configurable processing limits for JSON generator (StreamWriteConstraints) #1048

Closed
cowtowncoder opened this issue Jun 12, 2023 · 0 comments
Labels
2.16 Issue planned (at earliest) for 2.16 processing-limits Issues related to limiting aspects of input/output that can be processed without exception

Comments

@cowtowncoder
Copy link
Member

cowtowncoder commented Jun 12, 2023

Similar to #637, but for generation side, we may want to limit amount of processing based on some criteria.
Compared to input side, constraining generation may be less important for DoS reasons, but there are some aspects that seem like they would benefit from having limits.

First: limiting maximum nesting depth (defaulting to, say, 1000 levels). While this may not be an easy DoS attack vector, it is an accidental "own goal" case where a (relatively) common case where attempts to serialize cyclic data structures may result in StackOverflowError. While there are possible approaches to preventing this using other mechanisms, capping maximum nesting would be a straight-forward an efficient way to avoid SOE and resulting major resource drainage: instead of having to maintain a partial object graph to look for "back links", we simply keep track of nesting level. This can be configured to value that is high enough not to block typical legit sage, but prevent recursion by serializers to level well before SOE.

Other possible later additions could include:

but these are just speculative ones, not requested at this point.

As to possible implementation: this should follow pattern established with #637 adding StreamWriteConstraints, starting with the first implementation. We probably should allow something similar to #1019 immediately as well (wrt static default override).

@cowtowncoder cowtowncoder added 2.16 Issue planned (at earliest) for 2.16 processing-limits Issues related to limiting aspects of input/output that can be processed without exception labels Jun 12, 2023
@cowtowncoder cowtowncoder changed the title Add configurable "document/processing limits" for JSON generator Add configurable processing limits for JSON generator Jun 12, 2023
@cowtowncoder cowtowncoder changed the title Add configurable processing limits for JSON generator Add configurable processing limits for JSON generator (StreamWriteConstraints) Jun 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
2.16 Issue planned (at earliest) for 2.16 processing-limits Issues related to limiting aspects of input/output that can be processed without exception
Projects
None yet
Development

No branches or pull requests

1 participant