You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fory.apache.org by "chaokunyang (via GitHub)" <gi...@apache.org> on 2026/02/25 16:47:34 UTC
[I] [Dart] configurable size guardrails for untrusted payloads [fory]
chaokunyang opened a new issue, #3415:
URL: https://github.com/apache/fory/issues/3415
### Feature Request
Add configurable deserialization size guardrails in Fory Dart for untrusted payloads.
### Is your feature request related to a problem? Please describe
There are currently no configurable limits for payload-driven lengths. Untrusted string/map/list lengths can trigger large allocations and memory pressure.
### Describe the solution you'd like
Add configurable size limits to Dart deserialization and enforce them in list/map/string paths.
Resolve task:
- Add guardrail fields in `dart/packages/fory/lib/src/config/fory_config.dart`.
- Enforce collection length limits in `dart/packages/fory/lib/src/serializer/collection/list/list_serializer.dart`.
- Enforce map length limits in `dart/packages/fory/lib/src/serializer/collection/map/map_serializer.dart`.
- Enforce string byte-length limits in `dart/packages/fory/lib/src/serializer/string_serializer.dart` (and `ByteReader` reads as needed).
- Throw a deserialization exception when a configured limit is exceeded.
### Describe alternatives you've considered
Relying only on process-level memory limits and VM/runtime behavior. This is late-failing and not protocol-aware.
### Additional context
Medium: no configurable size guardrails for untrusted payloads (string/map/list lengths can drive large allocations).
Related locations:
- `dart/packages/fory/lib/src/config/fory_config.dart:20`
- `dart/packages/fory/lib/src/serializer/collection/list/list_serializer.dart:35`
- `dart/packages/fory/lib/src/serializer/collection/list/default_list_serializer.dart:52`
- `dart/packages/fory/lib/src/serializer/collection/map/map_serializer.dart:53`
- `dart/packages/fory/lib/src/serializer/collection/map/map_serializer.dart:54`
- `dart/packages/fory/lib/src/serializer/string_serializer.dart:76`
- `dart/packages/fory/lib/src/serializer/string_serializer.dart:99`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [I] [Dart] configurable size guardrails for untrusted payloads [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang closed issue #3415: [Dart] configurable size guardrails for untrusted payloads
URL: https://github.com/apache/fory/issues/3415
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [I] [Dart] configurable size guardrails for untrusted payloads [fory]
Posted by "yash-agarwa-l (via GitHub)" <gi...@apache.org>.
yash-agarwa-l commented on issue #3415:
URL: https://github.com/apache/fory/issues/3415#issuecomment-3976550484
HI, I'd like to work on this issue. I'll submit a PR soon.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [I] [Dart] configurable size guardrails for untrusted payloads [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang commented on issue #3415:
URL: https://github.com/apache/fory/issues/3415#issuecomment-3976584182
@miantalha45 I suggest you to optimzie exisitn pull request to get it merged first
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [I] [Dart] configurable size guardrails for untrusted payloads [fory]
Posted by "miantalha45 (via GitHub)" <gi...@apache.org>.
miantalha45 commented on issue #3415:
URL: https://github.com/apache/fory/issues/3415#issuecomment-3976571052
Hi @chaokunyang
I have submitted PRs for issues assigned to me. now can i take this issue?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [I] [Dart] configurable size guardrails for untrusted payloads [fory]
Posted by "miantalha45 (via GitHub)" <gi...@apache.org>.
miantalha45 commented on issue #3415:
URL: https://github.com/apache/fory/issues/3415#issuecomment-3976589443
ok @chaokunyang
I will optimize them first accordig to your suggestions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org