pjfanning opened a new pull request, #3523:
URL: https://github.com/apache/pekko/pull/3523
### Motivation
Backport of #3491 and its follow-up #3515 to 1.7.x:
- #3491 bounded Jackson payload decompression, which was previously
unbounded (an
unbounded gzip copy, and an LZ4 decompressor allocation sized from a
wire-declared
length with no upper check) — a small, well-formed message could drive an
`OutOfMemoryError` on deserialization.
- #3515 changed the bound's default from 256 MiB to unlimited
(`-1`/`unlimited` both
accepted), so a patch release does not start rejecting a payload an
existing system
legitimately exchanges. The bound stays available and opt-in.
### Modification
Cherry-pick of fd19b01453 (#3491) and 9d80429d4c (#3515, itself a squash of
the
default-to-unlimited change and the later "also accept `unlimited`"
follow-up from
review).
**Scope note:** both commits also touch `serialization-jackson3`, which does
not exist
as a module on 1.7.x (Jackson 3 support is new in the 2.x line — see the
"New configuration" section of the 2.x migration guide, PR2348). Those hunks
were
dropped; only the `serialization-jackson` (Jackson 2) changes are included
here.
**2.12 adaptation:** the merged `maxDecompressedSize` used
`raw.toLongOption`, which
Scala 2.12 does not have. Rewritten with `toLong` in a `try`/`catch
NumberFormatException`,
same shape as the fix already needed for the #3503 backport (#3517).
### Result
- `pekko.serialization.jackson.compression.max-decompressed-size` defaults to
`unlimited`; both `unlimited` and a negative number such as `-1` disable
the bound.
- A configured size (e.g. `256 MiB`) bounds decompression exactly as in
#3491: an
over-expanding gzip payload or an LZ4 payload declaring a length past the
limit is
rejected with an `IllegalArgumentException` before the large allocation,
instead of
risking `OutOfMemoryError`.
### Tests
- `sbt "++ 2.12.21 serialization-jackson/Test/compile"` — clean, validating
Scala 2.12
- `sbt "serialization-jackson/testOnly
org.apache.pekko.serialization.jackson.*"` — 123 passed, 1 pending
- `sbt "serialization-jackson/scalafmtCheckAll"` — clean
### References
Backport of #3491 and #3515.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
