Formed in 2009, the Archive Team (not to be confused with the archive.org Archive-It Team) is a rogue archivist collective dedicated to saving copies of rapidly dying or deleted websites for the sake of history and digital heritage. The group is 100% composed of volunteers and interested parties, and has expanded into a large amount of related projects for saving online and digital history.
Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upAdd MaxDepth as a config option #418
Conversation
Defaults to 10,000 to match the existing maxDepth constant everywhetre, except when using `ConfigCompatibleWithStandardLibrary` - which retains the limitless depth (and causes a stack overflow). Added tests for the new config, and also up to jsoniter's stack overflow limit.
Codecov Report
@@ Coverage Diff @@
## master #418 +/- ##
==========================================
+ Coverage 86.45% 86.54% +0.08%
==========================================
Files 41 41
Lines 5102 5105 +3
==========================================
+ Hits 4411 4418 +7
+ Misses 555 551 -4
Partials 136 136
Continue to review full report at Codecov.
|
Document Go json-iter's configurable max depth limit via `Config.MaxDepth` json-iterator/go#418
Document Go json-iter's configurable max depth limit via `Config.MaxDepth` json-iterator/go#418
|
"Compatible with the standard library" in this case means "vulnerable to stack overflow". I would strongly recommend this not be configurable and default safe. golang/go#31789 is targeting go1.15 |
| @@ -56,6 +60,7 @@ var ConfigCompatibleWithStandardLibrary = Config{ | |||
| EscapeHTML: true, | |||
| SortMapKeys: true, | |||
| ValidateJsonRawMessage: true, | |||
| MaxDepth: -1, // encoding/json has no max depth (stack overflow at 2581101) | |||
liggitt
Dec 19, 2019
Contributor
this seems like a harmful default
this seems like a harmful default
|
Making this configurable, and making a widely used default config setting unsafe means all transitive consumers of this library (caller -> library they don't control -> json-iterator) are exposed to stack overflows once again. I would strongly recommend this be reverted before tagging a release |
Revert "Merge pull request #418 from bbrks/configurable_maxDepth"
Default
MaxDepthis 10,000 to match the existingmaxDepthconstant added in #410ConfigCompatibleWithStandardLibraryretains unlimited depth (via-1), until golang/go#31789 has been decided (it got dropped from the 1.14 milestone)