[PR] fix: bound Jackson payload decompression size, unlimited by default (#3491, #3515) [pekko]

["pjfanning (via GitHub)" <gi...@apache.org>]

pjfanning opened a new pull request, #3523:
URL: https://github.com/apache/pekko/pull/3523

   ### Motivation
   Backport of #3491 and its follow-up #3515 to 1.7.x:
   
   - #3491 bounded Jackson payload decompression, which was previously unbounded (an
     unbounded gzip copy, and an LZ4 decompressor allocation sized from a wire-declared
     length with no upper check) — a small, well-formed message could drive an
     `OutOfMemoryError` on deserialization.
   - #3515 changed the bound's default from 256 MiB to unlimited (`-1`/`unlimited` both
     accepted), so a patch release does not start rejecting a payload an existing system
     legitimately exchanges. The bound stays available and opt-in.
   
   ### Modification
   Cherry-pick of fd19b01453 (#3491) and 9d80429d4c (#3515, itself a squash of the
   default-to-unlimited change and the later "also accept `unlimited`" follow-up from
   review).
   
   **Scope note:** both commits also touch `serialization-jackson3`, which does not exist
   as a module on 1.7.x (Jackson 3 support is new in the 2.x line — see the
   "New configuration" section of the 2.x migration guide, PR2348). Those hunks were
   dropped; only the `serialization-jackson` (Jackson 2) changes are included here.
   
   **2.12 adaptation:** the merged `maxDecompressedSize` used `raw.toLongOption`, which
   Scala 2.12 does not have. Rewritten with `toLong` in a `try`/`catch NumberFormatException`,
   same shape as the fix already needed for the #3503 backport (#3517).
   
   ### Result
   - `pekko.serialization.jackson.compression.max-decompressed-size` defaults to
     `unlimited`; both `unlimited` and a negative number such as `-1` disable the bound.
   - A configured size (e.g. `256 MiB`) bounds decompression exactly as in #3491: an
     over-expanding gzip payload or an LZ4 payload declaring a length past the limit is
     rejected with an `IllegalArgumentException` before the large allocation, instead of
     risking `OutOfMemoryError`.
   
   ### Tests
   - `sbt "++ 2.12.21 serialization-jackson/Test/compile"` — clean, validating Scala 2.12
   - `sbt "serialization-jackson/testOnly org.apache.pekko.serialization.jackson.*"` — 123 passed, 1 pending
   - `sbt "serialization-jackson/scalafmtCheckAll"` — clean
   
   ### References
   Backport of #3491 and #3515.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org

Re: [PR] fix: bound Jackson payload decompression size, unlimited by default (#3491, #3515) [pekko]

["pjfanning (via GitHub)" <gi...@apache.org>]

pjfanning merged PR #3523:
URL: https://github.com/apache/pekko/pull/3523


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org