-
-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Optimize JsonNodeDeserialization wrt recursion #3397
Copy link
Copy link
Closed
Labels
CVEIssues related to public CVEs (security vuln reports)Issues related to public CVEs (security vuln reports)performanceIssue related to performance problems or enhancementsIssue related to performance problems or enhancements
Milestone
Description
(note: cleaved off of #2816, used to be bundled)
Current implementation JsonNodeDeserialization is expensive for deeply nested Object and Array values as it uses recursion: so for each small additional nesting level -- for arrays, 2 bytes to encode [ and ] -- a new stack frame gets created.
In practical terms this means that it is possible to exhaust JVM heap usage with document that has nesting in order of ten thousand(s) levels, depending on settings.
It should be possible to replace basic recursion, however, with iteration, to at least significantly reduce amplification: to prevent cheapest potential DoS concerns.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
CVEIssues related to public CVEs (security vuln reports)Issues related to public CVEs (security vuln reports)performanceIssue related to performance problems or enhancementsIssue related to performance problems or enhancements