FasterXML / FasterXML/jackson-databind

`DecimalNode` to `BigInteger` conversion no longer guarded by `StreamReadConstraints.validateBigIntegerScale()`

Open Beginner friendly
#6,214 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
3.7k
Forks
1.5k
Avg merge
3d 6h
Merged PRs (30d)
28

Description

In 2.x, every `DecimalNode` → `BigInteger` conversion went through `BaseJsonNode._bigIntFromBigDec()`, which calls `StreamReadConstraints.defaults().validateBigIntegerScale(value.scale())` before `BigDecimal.toBigInteger()` (added for #3864). That guard exists because `toBigInteger()` on a `BigDecimal` with huge scale magnitude is extremely expensive (computes 10^|scale|), while the textual form is tiny — `1e2000000000` is 12 characters, so `maxNumberLength` doesn't help.

In 3.x the guard is gone: `DecimalNode._asBigIntegerValueUnchecked()` is a bare `_value.toBigInteger()` (dropped in the #4970 number-accessor rework). Streaming parsers are still guarded (`ParserBase.convertNumberToBigInteger()`), and `BigIntegerDeserializer` / `TokenBuffer` still validate, but the `JsonNode` accessors are not:

```java
ObjectMapper mapper = JsonMapper.builder().enable(DeserializationFeature.USE_BIG_DECIMAL_FOR_FLOATS).build();
JsonNode n = mapper.readTree("1e2000000000");
n.bigIntegerValue(); // CPU/memory DoS, no StreamConstraintsException
```

Same via `TreeTraversingParser.getBigIntegerValue()` (which is also how tree-backed format parsers such as TOML expose numbers), and via `asBigInteger()` / `bigIntegerValueOpt()` etc. — all six accessors funnel through `_asBigIntegerValueUnchecked()`.

Fix: restore the check in `DecimalNode._asBigIntegerValueUnchecked()` (using `StreamReadConstraints.defaults()`, as 2.x did, since nodes don't carry the configured constraints). PR to follow.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at DecimalNode._asBigIntegerValueUnchecked() and compare its conversion with the existing StreamReadConstraints validation described for 2.x and streaming parsers. Restore validation using StreamReadConstraints.defaults(); done means values with huge BigDecimal scales raise StreamConstraintsException instead of performing an expensive conversion.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.