pjfanning opened a new pull request, #3515: URL: https://github.com/apache/pekko/pull/3515
### Motivation #3491 bounded Jackson payload decompression with `pekko.serialization.jackson.compression.max-decompressed-size`, defaulting to 256 MiB. A bounded default could reject a payload an existing system legitimately exchanges, so a patch release carrying it could break running systems on upgrade, and there is no default that is provably above every deployment's largest payload. The bound should be opt-in, matching the change made to `pekko.serialization.max-decompressed-size` in #3502. ### Modification Default the setting to `-1`, meaning no limit and matching the behaviour of releases before #3491, in both `serialization-jackson` and `serialization-jackson3`. Operators who want the protection set a size such as `256 MiB`, larger than anything their system legitimately sends. A negative maximum skips the gzip size check and the LZ4 declared-size check. A negative *declared* LZ4 size is still rejected — it is malformed regardless of the limit — and now with a message saying that, rather than one claiming it exceeds the maximum. Config's `getBytes` refuses negative numbers, so the setting is read as a plain long first and as a memory size only when that is not a negative number. ### Result Jackson payload decompression is unbounded by default; configuring a size bounds it. A configured limit behaves exactly as before. ### Tests Two new tests per module (so each runs under both the JSON and CBOR serializers): - `apply no gzip decompression limit when max-decompressed-size is -1` - `apply no lz4 decompression limit when max-decompressed-size is -1` Both were checked to discriminate by reverting the production change and re-running: each then fails with `ConfigException$BadValue: Attempt to construct memory size with negative number: -1`, which is also what an operator configuring `-1` on the current code would get at serializer construction. - `sbt "serialization-jackson/testOnly org.apache.pekko.serialization.jackson.*"` — 122 passed, 1 pending - `sbt "serialization-jackson3/testOnly org.apache.pekko.serialization.jackson3.*"` — 120 passed, 1 pending - `sbt "serialization-jackson/scalafmtCheckAll" "serialization-jackson3/scalafmtCheckAll"` — clean - `sbt "serialization-jackson/mimaReportBinaryIssues"` — no issues (`serialization-jackson3` disables MimaPlugin) ### References Refs #3491, Refs #3502 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
