You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fory.apache.org by "yash-agarwa-l (via GitHub)" <gi...@apache.org> on 2026/02/28 08:26:45 UTC
[PR] feat(dart): add configurable deserialization size guardrails [fory]
yash-agarwa-l opened a new pull request, #3434:
URL: https://github.com/apache/fory/pull/3434
## Why?
Untrusted payloads can encode arbitrarily large collection/binary lengths,
causing pre-allocation of huge buffers and OOM crashes before any
elements are even deserialized.
## What does this PR do?
- Adds two nullable config options `maxBinarySize` and `maxCollectionSize`
to `ForyConfig` (defaults to `null` = unlimited, fully backward-compatible).
- Threads `ForyConfig` into `DeserializationContext` so serializers can
access limits at read time.
- Adds `DeserializationSizeException` following existing exception conventions.
- Enforces `maxCollectionSize` in `ListSerializer`, `SetSerializer`, and
`MapSerializer` before pre-allocation.
- Enforces `maxBinarySize` in `NumericArraySerializer` for `ObjType.BINARY`
before buffer copy.
- Adds 15 test cases covering within-limit, at-limit, exceeded, empty,
and null (unlimited) scenarios for lists, sets, maps, and binary.
## Related issues
Closes #3415.
## Does this PR introduce any user-facing change?
- [x] Does this PR introduce any public API change?
- [ ] Does this PR introduce any binary protocol compatibility change?
## Benchmark
N/A — guard checks are a single null-check + comparison per
collection/binary read; no measurable performance impact.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang commented on PR #3434:
URL: https://github.com/apache/fory/pull/3434#issuecomment-3976935334
Please rename `size_guardrail_test.dart` to `size_guard_test.dart`, other parts look good to me
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang commented on PR #3434:
URL: https://github.com/apache/fory/pull/3434#issuecomment-3977007977
You added two same tests file...:
- dart/packages/fory-test/test/config_test/size_guard_test.dart
- dart/packages/fory-test/test/config_test/size_guardrail_test.dart
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang commented on code in PR #3434:
URL: https://github.com/apache/fory/pull/3434#discussion_r2867312639
##########
dart/packages/fory/lib/src/serializer/collection/map/map_serializer.dart:
##########
@@ -52,10 +52,9 @@ abstract base class MapSerializer<T extends Map<Object?, Object?>>
@override
T read(ByteReader br, int refId, DeserializationContext pack) {
int remaining = br.readVarUint32Small7();
- final int? maxCollectionSize = pack.config.maxCollectionSize;
- if (maxCollectionSize != null && remaining > maxCollectionSize) {
- throw DeserializationSizeException(
- 'Collection', remaining, maxCollectionSize);
+ if (remaining > pack.config.maxCollectionSize) {
+ throw InvalidDataException(
+ 'Collection size $remaining exceeds limit ${pack.config.maxCollectionSize}');
Review Comment:
Please refine thev error message, to tell user either the inout data is malicouse , or user need to increase maxCollectionSize or maxBinarySize when creating Fory. ditto for other InvalidDataException construction
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "yash-agarwa-l (via GitHub)" <gi...@apache.org>.
yash-agarwa-l commented on PR #3434:
URL: https://github.com/apache/fory/pull/3434#issuecomment-3976759211
Thanks for the reviews, I have made the changes and will also put up a PR for the exceptions.
Just a follow up -- I’ve added a new commit for now. Although it will be squashed into a single commit, is there a preference to amend the original commit, or is a new commit fine?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang commented on code in PR #3434:
URL: https://github.com/apache/fory/pull/3434#discussion_r2867272619
##########
dart/packages/fory/lib/src/serializer/collection/map/map_serializer.dart:
##########
@@ -51,6 +52,11 @@ abstract base class MapSerializer<T extends Map<Object?, Object?>>
@override
T read(ByteReader br, int refId, DeserializationContext pack) {
int remaining = br.readVarUint32Small7();
+ final int? maxCollectionSize = pack.config.maxCollectionSize;
Review Comment:
you should set a default value for maxCollectionSize and maxBinary Size instead use null to span across whole repo
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "yash-agarwa-l (via GitHub)" <gi...@apache.org>.
yash-agarwa-l commented on PR #3434:
URL: https://github.com/apache/fory/pull/3434#issuecomment-3976829857
changes made, PTAL.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang commented on code in PR #3434:
URL: https://github.com/apache/fory/pull/3434#discussion_r2867271702
##########
dart/packages/fory/lib/src/exception/deserialization_exception.dart:
##########
@@ -147,3 +147,22 @@ class UnsupportedTypeException extends ForyException {
buf.writeln(_objType);
}
}
+
+class DeserializationSizeException extends DeserializationException {
Review Comment:
We dont' need so many special exception. Could you create a `InvalidDataException` in dart/packages/fory/lib/src/exception/fory_exception.dart?
Adn open anoterh PR to merge all excpetions into one file name fory_exception.dart under dart/packages/fory/lib/src/ dir? Current fory dart is too java style
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang commented on code in PR #3434:
URL: https://github.com/apache/fory/pull/3434#discussion_r2867354917
##########
dart/packages/fory-test/test/config_test/size_guardrail_test.dart:
##########
@@ -0,0 +1,199 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+library;
+
+import 'dart:typed_data';
+import 'package:fory/fory.dart';
+import 'package:fory/src/exception/fory_exception.dart';
+import 'package:test/test.dart';
+
+void main() {
+ group('maxCollectionSize guardrail', () {
Review Comment:
```suggestion
group('maxCollectionSize guard check', () {
```
##########
dart/packages/fory-test/test/config_test/size_guardrail_test.dart:
##########
@@ -0,0 +1,199 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+library;
+
+import 'dart:typed_data';
+import 'package:fory/fory.dart';
+import 'package:fory/src/exception/fory_exception.dart';
+import 'package:test/test.dart';
+
+void main() {
+ group('maxCollectionSize guardrail', () {
+ test('list within limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize([1, 2, 3]);
+
+ final foryRead = Fory(maxCollectionSize: 10);
+ final result = foryRead.deserialize(bytes);
+ expect(result, equals([1, 2, 3]));
+ });
+
+ test('list exceeding limit throws InvalidDataException', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize([1, 2, 3, 4, 5]);
+
+ final foryRead = Fory(maxCollectionSize: 3);
+ expect(
+ () => foryRead.deserialize(bytes),
+ throwsA(isA<InvalidDataException>()),
+ );
+ });
+
+ test('list at exact limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize([1, 2, 3]);
+
+ final foryRead = Fory(maxCollectionSize: 3);
+ final result = foryRead.deserialize(bytes);
+ expect(result, equals([1, 2, 3]));
+ });
+
+ test('empty list always deserializes successfully', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize(<int>[]);
+
+ final foryRead = Fory(maxCollectionSize: 0);
+ final result = foryRead.deserialize(bytes);
+ expect(result, equals([]));
+ });
+
+ test('map exceeding limit throws InvalidDataException', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize({'a': 1, 'b': 2, 'c': 3});
+
+ final foryRead = Fory(maxCollectionSize: 2);
+ expect(
+ () => foryRead.deserialize(bytes),
+ throwsA(isA<InvalidDataException>()),
+ );
+ });
+
+ test('map within limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize({'a': 1, 'b': 2});
+
+ final foryRead = Fory(maxCollectionSize: 10);
+ final result = foryRead.deserialize(bytes);
+ expect(result, equals({'a': 1, 'b': 2}));
+ });
+
+ test('set exceeding limit throws InvalidDataException', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize({1, 2, 3, 4, 5});
+
+ final foryRead = Fory(maxCollectionSize: 2);
+ expect(
+ () => foryRead.deserialize(bytes),
+ throwsA(isA<InvalidDataException>()),
+ );
+ });
+
+ test('set within limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize({1, 2, 3});
+
+ final foryRead = Fory(maxCollectionSize: 10);
+ final result = foryRead.deserialize(bytes);
+ expect(result, equals({1, 2, 3}));
+ });
+
+ test('default maxCollectionSize allows normal sizes', () {
+ final foryWrite = Fory();
+ final largeList = List.generate(1000, (i) => i);
+ final bytes = foryWrite.serialize(largeList);
+
+ final foryRead = Fory();
+ final result = foryRead.deserialize(bytes) as List;
+ expect(result.length, 1000);
+ });
+ });
+
+ group('maxBinarySize guardrail', () {
+ test('binary within limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final data = Uint8List.fromList([1, 2, 3, 4, 5]);
+ final bytes = foryWrite.serialize(data);
+
+ final foryRead = Fory(maxBinarySize: 10);
+ final result = foryRead.deserialize(bytes) as Uint8List;
+ expect(result, equals(data));
+ });
+
+ test('binary exceeding limit throws InvalidDataException', () {
+ final foryWrite = Fory();
+ final data = Uint8List.fromList([1, 2, 3, 4, 5]);
+ final bytes = foryWrite.serialize(data);
+
+ final foryRead = Fory(maxBinarySize: 3);
+ expect(
+ () => foryRead.deserialize(bytes),
+ throwsA(isA<InvalidDataException>()),
+ );
+ });
+
+ test('binary at exact limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final data = Uint8List.fromList([1, 2, 3]);
+ final bytes = foryWrite.serialize(data);
+
+ final foryRead = Fory(maxBinarySize: 3);
+ final result = foryRead.deserialize(bytes) as Uint8List;
+ expect(result, equals(data));
+ });
+
+ test('empty binary always deserializes successfully', () {
+ final foryWrite = Fory();
+ final data = Uint8List(0);
+ final bytes = foryWrite.serialize(data);
+
+ final foryRead = Fory(maxBinarySize: 0);
+ final result = foryRead.deserialize(bytes) as Uint8List;
+ expect(result, equals(data));
+ });
+
+ test('default maxBinarySize allows normal sizes', () {
+ final foryWrite = Fory();
+ final data = Uint8List.fromList(List.generate(1000, (i) => i % 256));
+ final bytes = foryWrite.serialize(data);
+
+ final foryRead = Fory();
+ final result = foryRead.deserialize(bytes) as Uint8List;
+ expect(result.length, 1000);
+ });
+ });
+
+ group('combined guardrails', () {
Review Comment:
rename all guardrails to `guard check`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "yash-agarwa-l (via GitHub)" <gi...@apache.org>.
yash-agarwa-l commented on PR #3434:
URL: https://github.com/apache/fory/pull/3434#issuecomment-3977014584
My bad, I missed to add that change that time
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang commented on code in PR #3434:
URL: https://github.com/apache/fory/pull/3434#discussion_r2867272927
##########
dart/packages/fory/lib/src/serializer/collection/map/map_serializer.dart:
##########
@@ -51,6 +52,11 @@ abstract base class MapSerializer<T extends Map<Object?, Object?>>
@override
T read(ByteReader br, int refId, DeserializationContext pack) {
int remaining = br.readVarUint32Small7();
+ final int? maxCollectionSize = pack.config.maxCollectionSize;
Review Comment:
Set maxCollectionSize to 1000_000, and maxBinarySize default to 64MB
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang commented on code in PR #3434:
URL: https://github.com/apache/fory/pull/3434#discussion_r2867354623
##########
dart/packages/fory-test/test/config_test/size_guardrail_test.dart:
##########
@@ -0,0 +1,199 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+library;
+
+import 'dart:typed_data';
+import 'package:fory/fory.dart';
+import 'package:fory/src/exception/fory_exception.dart';
+import 'package:test/test.dart';
+
+void main() {
+ group('maxCollectionSize guardrail', () {
+ test('list within limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize([1, 2, 3]);
+
+ final foryRead = Fory(maxCollectionSize: 10);
+ final result = foryRead.deserialize(bytes);
+ expect(result, equals([1, 2, 3]));
+ });
+
+ test('list exceeding limit throws InvalidDataException', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize([1, 2, 3, 4, 5]);
+
+ final foryRead = Fory(maxCollectionSize: 3);
+ expect(
+ () => foryRead.deserialize(bytes),
+ throwsA(isA<InvalidDataException>()),
+ );
+ });
+
+ test('list at exact limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize([1, 2, 3]);
+
+ final foryRead = Fory(maxCollectionSize: 3);
+ final result = foryRead.deserialize(bytes);
+ expect(result, equals([1, 2, 3]));
+ });
+
+ test('empty list always deserializes successfully', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize(<int>[]);
+
+ final foryRead = Fory(maxCollectionSize: 0);
+ final result = foryRead.deserialize(bytes);
+ expect(result, equals([]));
+ });
+
+ test('map exceeding limit throws InvalidDataException', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize({'a': 1, 'b': 2, 'c': 3});
+
+ final foryRead = Fory(maxCollectionSize: 2);
+ expect(
+ () => foryRead.deserialize(bytes),
+ throwsA(isA<InvalidDataException>()),
+ );
+ });
+
+ test('map within limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize({'a': 1, 'b': 2});
+
+ final foryRead = Fory(maxCollectionSize: 10);
+ final result = foryRead.deserialize(bytes);
+ expect(result, equals({'a': 1, 'b': 2}));
+ });
+
+ test('set exceeding limit throws InvalidDataException', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize({1, 2, 3, 4, 5});
+
+ final foryRead = Fory(maxCollectionSize: 2);
+ expect(
+ () => foryRead.deserialize(bytes),
+ throwsA(isA<InvalidDataException>()),
+ );
+ });
+
+ test('set within limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final bytes = foryWrite.serialize({1, 2, 3});
+
+ final foryRead = Fory(maxCollectionSize: 10);
+ final result = foryRead.deserialize(bytes);
+ expect(result, equals({1, 2, 3}));
+ });
+
+ test('default maxCollectionSize allows normal sizes', () {
+ final foryWrite = Fory();
+ final largeList = List.generate(1000, (i) => i);
+ final bytes = foryWrite.serialize(largeList);
+
+ final foryRead = Fory();
+ final result = foryRead.deserialize(bytes) as List;
+ expect(result.length, 1000);
+ });
+ });
+
+ group('maxBinarySize guardrail', () {
+ test('binary within limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final data = Uint8List.fromList([1, 2, 3, 4, 5]);
+ final bytes = foryWrite.serialize(data);
+
+ final foryRead = Fory(maxBinarySize: 10);
+ final result = foryRead.deserialize(bytes) as Uint8List;
+ expect(result, equals(data));
+ });
+
+ test('binary exceeding limit throws InvalidDataException', () {
+ final foryWrite = Fory();
+ final data = Uint8List.fromList([1, 2, 3, 4, 5]);
+ final bytes = foryWrite.serialize(data);
+
+ final foryRead = Fory(maxBinarySize: 3);
+ expect(
+ () => foryRead.deserialize(bytes),
+ throwsA(isA<InvalidDataException>()),
+ );
+ });
+
+ test('binary at exact limit deserializes successfully', () {
+ final foryWrite = Fory();
+ final data = Uint8List.fromList([1, 2, 3]);
+ final bytes = foryWrite.serialize(data);
+
+ final foryRead = Fory(maxBinarySize: 3);
+ final result = foryRead.deserialize(bytes) as Uint8List;
+ expect(result, equals(data));
+ });
+
+ test('empty binary always deserializes successfully', () {
+ final foryWrite = Fory();
+ final data = Uint8List(0);
+ final bytes = foryWrite.serialize(data);
+
+ final foryRead = Fory(maxBinarySize: 0);
+ final result = foryRead.deserialize(bytes) as Uint8List;
+ expect(result, equals(data));
+ });
+
+ test('default maxBinarySize allows normal sizes', () {
+ final foryWrite = Fory();
+ final data = Uint8List.fromList(List.generate(1000, (i) => i % 256));
+ final bytes = foryWrite.serialize(data);
+
+ final foryRead = Fory();
+ final result = foryRead.deserialize(bytes) as Uint8List;
+ expect(result.length, 1000);
+ });
+ });
+
+ group('combined guardrails', () {
Review Comment:
rename all guardrails to `size check`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "yash-agarwa-l (via GitHub)" <gi...@apache.org>.
yash-agarwa-l commented on PR #3434:
URL: https://github.com/apache/fory/pull/3434#issuecomment-3976996838
done!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat(dart): add configurable deserialization size guardrails [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang merged PR #3434:
URL: https://github.com/apache/fory/pull/3434
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org