FasterXML / FasterXML/jackson-databind

Jackson StringNode has code to parse strings to numbers

Open
#6,131 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
3.7k
Forks
1.5k
Avg merge
3d 6h
Merged PRs (30d)
28

Description

In a lot of our code, we try to avoid letting big strings be parsed into numbers because of the risk of long strings causing long parse times - that have worse than O(n) complexity.
StringNode appears to be a Jackson 3 only class but there might be something equivalent in Jackson 2.

https://github.com/FasterXML/jackson-databind/blob/dc06c7e50acf18e808408edaaa53f4a442ca881b/src/main/java/tools/jackson/databind/node/StringNode.java#L398

Even if our main code paths for creating StringNodes apply our String length constraint - that max string len is expected to be significantly longer than the max number len.

Another issue is getting access to the stream read constraints because we don't really have access to the DeserializationContext here. We could use StreamReadConstraints.defaults() and we do allow users to replace the defaults if they don't like them but it isn't as tidy as having the constraints tied to the JsonFactory or the Deserialization Context.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with src/main/java/tools/jackson/databind/node/StringNode.java around line 398, then look for the equivalent Jackson 2 implementation if it exists. Trace how string-length and numeric parsing constraints are available there; done means oversized string-to-number parsing is addressed without losing the intended user-configurable constraint behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend-api-design, performance
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.