[JENKINS-32433] folders should have a depth limit for rest api calls

When users are using the rest api interface with a folder, the depth limit allows very large amounts of data to be returned, which can overload Jenkins.

There is no way to stop this in Jenkins, only by using apache in front of Jenkins and blocking patterns and query strings is this possible.

CB published an article on how to use tree to limit this

https://www.cloudbees.com/blog/taming-jenkins-json-api-depth-and-tree

---
Originally reported by mjbros, imported from: folders should have a depth limit for rest api calls

• assignee: jglick
  
• status: Open
  
• priority: Minor
  
• component(s): cloudbees-folder-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 2
  
• imported: 20251211-141027
  

Raw content of original issue

When users are using the rest api interface with a folder, the depth limit allows very large amounts of data to be returned, which can overload Jenkins.


There is no way to stop this in Jenkins, only by using apache in front of Jenkins and blocking patterns and query strings is this possible.


CB published an article on how to use tree to limit this


https://www.cloudbees.com/blog/taming-jenkins-json-api-depth-and-tree

• environment: Cloudbees Jenkins 14.11