Dmytro Shteflyuk created THRIFT-6151:
----------------------------------------
Summary: Enforce the default Ruby receive message size limit
Key: THRIFT-6151
URL: https://issues.apache.org/jira/browse/THRIFT-6151
Project: Thrift
Issue Type: New Feature
Components: Ruby - Library
Reporter: Dmytro Shteflyuk
Assignee: Dmytro Shteflyuk
h3. Problem
The Ruby library does not enforce the Thrift default maximum message size
consistently across receive paths. Some framed and header transports enforce
format-specific limits, but Binary, Compact, and JSON protocol messages do not
share a cumulative receive budget.
Individual string and container preflight checks cannot enforce a limit across
an entire message. Layered transports also complicate accounting because
buffering and framing may read bytes from the underlying endpoint before the
protocol consumes them.
This issue is related to THRIFT-5938, which introduces the Ruby configuration
API that will make the limit configurable in a later change.
h3. Client impact
Ruby clients and servers cannot currently rely on the standard default
message-size bound across protocols and transport combinations. The effective
behavior varies between unframed, buffered, framed, header, and in-memory
deserialization paths.
The new enforcement must preserve valid wire behavior and avoid charging
buffered prefetch as if the protocol had already consumed those bytes.
h3. Proposed solution
Add receive-side message-size accounting with the standard 100 MiB default.
Keep the limit fixed in this issue so message enforcement remains independently
reviewable from the public {{Thrift::Configuration}} API.
Endpoint transports should own the active message budget. Layered transports
should delegate accounting to the wrapped endpoint while establishing
boundaries appropriate to their wire format. Protocol reads should consume
protocol-visible bytes, not bytes fetched speculatively into a wrapper buffer.
Framed accounting should include the frame prefix and reject an oversized frame
before reading its payload.
Binary, Compact, and JSON receive paths, including their native
implementations, should participate in the same accounting semantics.
Serializer and deserializer paths should bound their in-memory input by the
actual buffer size as well as the default limit.
Cumulative budget failures should raise
{{Thrift::TransportException::SIZE_LIMIT}}. Existing protocol-level string and
container allocation preflights should remain
{{Thrift::ProtocolException::SIZE_LIMIT}} checks.
The budget should begin lazily on the first receive operation, reset at message
boundaries, and apply only to reads in this issue. The implementation should
include focused coverage for endpoint and layered transports, all supported
protocols, native and pure-Ruby paths, frame-prefix accounting, buffered
prefetch, and in-memory deserialization.
Because transport and protocol reads are performance-sensitive, the change
should be benchmarked against master across Binary, Compact, and JSON
protocols, including native and pure-Ruby modes. Regressions above 5% should be
investigated before submission.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
