Commits on Jun 19, 2023

1. Introduce nesting depth limits for encoders and decoders …

   Create a new base class LimitingStream for all Decoder and Encoder implementations that checks the nesting depth. The nesting depth is configured using a new configuration property.
   
   The purpose of this is to harden against issues like FasterXML/jackson-databind#3972 . Another benefit is that accidental recursive data structures made by developers won't lead to a stack overflow but will be caught earlier with a nicer error message.
   
   This patch changes many classes, mostly because the new limit has to be propagated from the serde configuration to the encoders/decoders. To simplify addition of other limits in the future, I've wrapped the depth limit into an opaque data structure. Other possible limits would be e.g. on total output size or on array sizes.
   
   I've tried to keep this patch as compatible as possible even though it's only going into a major version, to make the release process easier. Methods that need the new limit parameter and were not internal I've deprecated.

   

   yawkat committed Jun 19, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 843a50a
   • Browse repository at this point

   Copy the full SHA

   843a50a View commit details

   Browse the repository at this point in the history