As things are, StreamReadConstraints.maxDocumentLength enforcement occurs when attempting to read more content. For actual protection purposes this makes sense and is sufficient, but it can be confusing when testing enforcement of constraints: if test passes byte[] (or char[]) of 10M, no validation exception is ever thrown no matter configured maximum length. So this reproduction fails:
StreamReadConstraints constraints = StreamReadConstraints.builder()
.maxDocumentLength(1L)
.build();
JsonFactory factory = JsonFactory.builder()
.streamReadConstraints(constraints)
.build();
byte[] payload = createPayload(100_000);
// This SHOULD throw an exception -- 100,000 bytes exceeds 1 byte limit
// Instead it parses successfully, proving the constraint is not enforced
try (JsonParser p = factory.createParser(payload)) {
while (p.nextToken() != null) { }
System.out.println("VULNERABILITY: 100K payload accepted with 1-byte limit!");
} catch (Exception e) {
System.out.println("PROTECTED: " + e.getClass().getSimpleName() + " - " + e.getMessage());
}
which may seem concerning, but would NOT occur if content was read using, say, ByteArrayInputStream.
NOTE: constraints are not designed to be byte-accurate (and this is documented), but since Jackson uses buffers of size 4k or 8k (depending) 100k is enough to trigger constraint validation unless full static buffer is passed.
As things are,
StreamReadConstraints.maxDocumentLengthenforcement occurs when attempting to read more content. For actual protection purposes this makes sense and is sufficient, but it can be confusing when testing enforcement of constraints: if test passesbyte[](orchar[]) of 10M, no validation exception is ever thrown no matter configured maximum length. So this reproduction fails:which may seem concerning, but would NOT occur if content was read using, say,
ByteArrayInputStream.NOTE: constraints are not designed to be byte-accurate (and this is documented), but since Jackson uses buffers of size 4k or 8k (depending) 100k is enough to trigger constraint validation unless full static buffer is passed.