FasterXML / FasterXML/jackson-dataformats-binary
`StreamReadConstaints` support in Ion dataformat
- 主要語言
- Java
- 星號
- 347
- 分支
- 156
- 平均合併
- 3 天 3 小時
- 30 天內合併 PR
- 22
描述
* I was looking for cases where TextBuffers are created and to changeover to the ReadConstrainedTextBuffer (as part of https://github.com/FasterXML/jackson-dataformats-binary/pull/357)
* Ion code base only uses a TextBuffer in deprecated code but the javadocs provide no hint of what new code to use and if the deprecated code is planned for removal
In IonFactory, there is
```
@Deprecated
protected String _readAll(Reader r, IOContext ctxt) throws IOException
{
// Let's use Jackson's efficient aggregators... better than JDK defaults
TextBuffer tb = ctxt.constructTextBuffer();
```
* so do we need to update this code, or ignore it?
* I wrote a test nonetheless. I know nothing about this Ion code but I copied an existing test to see if I could make it fail by setting a low maxStringSize. It does not fail.
```
@Test
public void testSimpleLowStringLimit() throws IOException {
Bean original = new Bean("parent_field", new ChildBean("child_field"));
IonFactory ionFactory = new IonFactoryBuilder(false)
.streamReadConstraints(StreamReadConstraints.builder().maxStringLength(1).build())
.build();
IonObjectMapper mapper = new IonObjectMapper(ionFactory);
mapper.registerModule(new IonAnnotationModule());
String serialized = mapper.writeValueAsString(original);
//the next call should fail because the streamReadConstraints have such a small maxStringLength
Bean deserialized = mapper.readValue(serialized, Bean.class);
assertEquals(original.field, deserialized.field);
assertEquals(original.child.someField, deserialized.child.someField);
}
```
* IonParser has its own code for `getText()` and theory that can be changed to validate the string lengths.
* I know nothing about Ion but it looks an IonReader provided by an AWS lib does the real parsing - so we may only be check the string len after that call (with the risk the string is huge already)
* maybe there is a way to get IonReader to check (which would be better because it could catch the issue earlier)
貢獻指南
這個儲存庫沒有索引到貢獻指南
評估
這個 Issue 還沒有評估資料。