FasterXML / jackson-dataformat-xml

Extension for Jackson JSON processor that adds support for serializing POJOs as XML (and deserializing from XML) as an alternative to JSON
Apache License 2.0
561 stars 221 forks source link

support for StreamReadConstraints #609

Open pjfanning opened 9 months ago

pjfanning commented 9 months ago

https://github.com/FasterXML/jackson-core/blob/2.16/src/main/java/com/fasterxml/jackson/core/StreamReadConstraints.java

In particular, the 2 new ones (in 2.16)

With maxNestingDepth, Woodstox has its own way to enforce that and users who need to enforce that should use jackson-dataformat-xml with woodstox as the XML Stream Reader. See https://cowtowncoder.medium.com/configuring-woodstox-xml-parser-woodstox-specific-properties-1ce5030a5173 and the part about P_MAX_ELEMENT_DEPTH.

maxDocumentLength could be enforced similarly - see P_MAX_CHARACTERS

maxStringLength could be enforced using P_MAX_TEXT_LENGTH