FasterXML / FasterXML/jackson-dataformats-binary
`StreamReadConstaints` support in Ion dataformat
- Dominant language
- Java
- Stars
- 347
- Forks
- 156
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 22
Description
* I was looking for cases where TextBuffers are created and to changeover to the ReadConstrainedTextBuffer (as part of https://github.com/FasterXML/jackson-dataformats-binary/pull/357)
* Ion code base only uses a TextBuffer in deprecated code but the javadocs provide no hint of what new code to use and if the deprecated code is planned for removal
In IonFactory, there is
```
@Deprecated
protected String _readAll(Reader r, IOContext ctxt) throws IOException
{
// Let's use Jackson's efficient aggregators... better than JDK defaults
TextBuffer tb = ctxt.constructTextBuffer();
```
* so do we need to update this code, or ignore it?
* I wrote a test nonetheless. I know nothing about this Ion code but I copied an existing test to see if I could make it fail by setting a low maxStringSize. It does not fail.
```
@Test
public void testSimpleLowStringLimit() throws IOException {
Bean original = new Bean("parent_field", new ChildBean("child_field"));
IonFactory ionFactory = new IonFactoryBuilder(false)
.streamReadConstraints(StreamReadConstraints.builder().maxStringLength(1).build())
.build();
IonObjectMapper mapper = new IonObjectMapper(ionFactory);
mapper.registerModule(new IonAnnotationModule());
String serialized = mapper.writeValueAsString(original);
//the next call should fail because the streamReadConstraints have such a small maxStringLength
Bean deserialized = mapper.readValue(serialized, Bean.class);
assertEquals(original.field, deserialized.field);
assertEquals(original.child.someField, deserialized.child.someField);
}
```
* IonParser has its own code for `getText()` and theory that can be changed to validate the string lengths.
* I know nothing about Ion but it looks an IonReader provided by an AWS lib does the real parsing - so we may only be check the string len after that call (with the risk the string is huge already)
* maybe there is a way to get IonReader to check (which would be better because it could catch the issue earlier)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.