google / gson

A Java serialization/deserialization library to convert Java Objects into JSON and back
Apache License 2.0
23.23k stars 4.27k forks source link

Add nesting limit for `JsonReader` #2588

Closed Marcono1234 closed 1 month ago

Marcono1234 commented 8 months ago

Purpose

Add nesting limit for JsonReader

Description

For now don't expose this as additional GsonBuilder method assuming that the default nesting limit is high enough for most users. Otherwise users can first obtain a JsonReader from Gson.newJsonReader and then set a custom nesting limit.

The reasons why this pull request makes the nesting limit configurable at all are

Checklist

Marcono1234 commented 2 months ago

@eamonnmcmanus regarding https://github.com/google/gson/discussions/2632#discussioncomment-9481105: Is there some general problem with this concept of a nesting limit or should I change something?

eamonnmcmanus commented 1 month ago

@eamonnmcmanus regarding #2632 (reply in thread): Is there some general problem with this concept of a nesting limit or should I change something?

Last time I looked, this triggered a test failure in a Google-internal test. I think what I might do is patch Google's internal copy of the Gson source code to increase the threshold so that test passes. I think the limit of 255 is reasonable for the public version. I'm looking into this now.