Top Description Inners Fields Constructors Methods
com.fasterxml.jackson.core

public Class StreamReadConstraints

extends Object
implements Serializable
Class Inheritance
All Implemented Interfaces
java.io.Serializable
Imports
com.fasterxml.jackson.core.exc.StreamConstraintsException
The constraints to use for streaming reads: used to guard against malicious input by preventing processing of "too big" input constructs (values, structures). Constraints are registered with TokenStreamFactory (such as JsonFactory); if nothing explicitly specified, default constraints are used.

Currently constrained aspects, with default settings, are:

Since
2.15

Nested and Inner Type Summary

Modifier and TypeClass and Description
public static class
StreamReadConstraints.Builder

Field Summary

Modifier and TypeField and Description
protected final long
_maxDocLen

protected final int
_maxNameLen

protected final int
_maxNestingDepth

protected final int
_maxNumLen

protected final int
_maxStringLen

protected final long
_maxTokenCount

private static StreamReadConstraints
DEFAULT

public static final int
DEFAULT_MAX_DEPTH

Default setting for maximum depth: see Builder#maxNestingDepth(int) for details.

public static final long
DEFAULT_MAX_DOC_LEN

Default setting for maximum document length: see Builder#maxDocumentLength for details.

public static final int
DEFAULT_MAX_NAME_LEN

Default setting for maximum name length: see Builder#maxNameLength(int) for details.

public static final int
DEFAULT_MAX_NUM_LEN

public static final int
DEFAULT_MAX_STRING_LEN

Default setting for maximum string length: see Builder#maxStringLength(int) for details.

public static final long
DEFAULT_MAX_TOKEN_COUNT

Default setting for maximum token count: see Builder#maxTokenCount for details.

private static final int
MAX_BIGINT_SCALE_MAGNITUDE

Limit for the maximum magnitude of Scale of java.math.BigDecimal that can be converted to java.math.BigInteger.

private static final long
serialVersionUID

Constructor Summary

AccessConstructor and Description
protected
StreamReadConstraints(final int maxNestingDepth, final long maxDocLen, final int maxNumLen, final int maxStringLen)
Deprecated

protected
StreamReadConstraints(final int
Maximum input document nesting to allow
maxNestingDepth, final long
Maximum input document length to allow
maxDocLen, final int
Maximum number representation length to allow
maxNumLen, final int
Maximum String value length to allow
maxStringLen, final int
Maximum Object property name length to allow
maxNameLen)
Deprecated

protected
StreamReadConstraints(final int
Maximum input document nesting to allow
maxNestingDepth, final long
Maximum input document length to allow
maxDocLen, final int
Maximum number representation length to allow
maxNumLen, final int
Maximum String value length to allow
maxStringLen, final int
Maximum Object property name length to allow
maxNameLen, final long
Maximum number of tokens to allow
maxTokenCount)

Method Summary

Modifier and TypeMethod and Description
protected String
_constrainRef(String method)

protected StreamConstraintsException
_constructException(String msgTemplate, Object... args)

public static StreamReadConstraints.Builder
builder()

public static StreamReadConstraints

Returns:

the default StreamReadConstraints (when none is set on the JsonFactory explicitly)
defaults()

public long

Returns:

Maximum allowed depth
getMaxDocumentLength()

Accessor for maximum document length.

public int

Returns:

Maximum allowed name length
getMaxNameLength()

Accessor for maximum length of names to decode.

public int

Returns:

Maximum allowed depth
getMaxNestingDepth()

Accessor for maximum depth.

public int

Returns:

Maximum allowed number length
getMaxNumberLength()

Accessor for maximum length of numbers to decode.

public int

Returns:

Maximum allowed string length
getMaxStringLength()

Accessor for maximum length of strings to decode.

public long

Returns:

Maximum allowed token count
getMaxTokenCount()

Accessor for maximum token count.

public boolean

Returns:

True if this constraints instance has a limit for maximum document length to enforce; false otherwise.
hasMaxDocumentLength()

Convenience method, basically same as: 

  getMaxDocumentLength() > 0L
public boolean

Returns:

True if this constraints instance has a limit for maximum token count to enforce; false otherwise.
hasMaxTokenCount()

Convenience method, basically same as: 

  getMaxTokenCount() > 0L
public static void
overrideDefaultStreamReadConstraints(final StreamReadConstraints
new default for StreamReadConstraints (a null value will reset to built-in default)
streamReadConstraints)

Override the default StreamReadConstraints.

public StreamReadConstraints.Builder

Returns:

New Builder initialized with settings of this constraints instance
rebuild()

public void
validateBigIntegerScale(int
Scale (possibly negative) of java.math.BigDecimal to convert
scale)

Convenience method that can be used to verify that a conversion to java.math.BigInteger StreamConstraintsException is thrown.

public void
validateDocumentLength(long
Current length of processed document content
len)

Convenience method that can be used to verify that the document length does not exceed the maximum specified by this constraints object (if any): if it does, a StreamConstraintsException is thrown.

public void
validateFPLength(int
Length of number in input units
length)

Convenience method that can be used to verify that a floating-point number of specified length does not exceed maximum specified by this constraints object: if it does, a StreamConstraintsException is thrown.

public void
validateIntegerLength(int
Length of number in input units
length)

Convenience method that can be used to verify that an integer number of specified length does not exceed maximum specific by this constraints object: if it does, a StreamConstraintsException is thrown.

public void
validateNameLength(int
Length of name in input units
length)

Convenience method that can be used to verify that a name of specified length does not exceed maximum specific by this constraints object: if it does, a StreamConstraintsException is thrown.

public void
validateNestingDepth(int
count of unclosed objects and arrays
depth)

Convenience method that can be used to verify that the nesting depth does not exceed the maximum specified by this constraints object: if it does, a StreamConstraintsException is thrown.

public void
validateStringLength(int
Length of string in input units
length)

Convenience method that can be used to verify that a String of specified length does not exceed maximum specific by this constraints object: if it does, a StreamConstraintsException is thrown.

public void
validateTokenCount(long
Current token count for processed document content
count)

Convenience method that can be used to verify that the token count does not exceed the maximum specified by this constraints object (if any): if it does, a StreamConstraintsException is thrown.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

_maxDocLenback to summary
protected final long _maxDocLen
_maxNameLenback to summary
protected final int _maxNameLen
_maxNestingDepthback to summary
protected final int _maxNestingDepth
_maxNumLenback to summary
protected final int _maxNumLen
_maxStringLenback to summary
protected final int _maxStringLen
_maxTokenCountback to summary
protected final long _maxTokenCount
DEFAULTback to summary
private static StreamReadConstraints DEFAULT
DEFAULT_MAX_DEPTHback to summary
public static final int DEFAULT_MAX_DEPTH

Default setting for maximum depth: see Builder#maxNestingDepth(int) for details.

DEFAULT_MAX_DOC_LENback to summary
public static final long DEFAULT_MAX_DOC_LEN

Default setting for maximum document length: see Builder#maxDocumentLength for details.

DEFAULT_MAX_NAME_LENback to summary
public static final int DEFAULT_MAX_NAME_LEN

Default setting for maximum name length: see Builder#maxNameLength(int) for details.

Since
2.16
DEFAULT_MAX_NUM_LENback to summary
public static final int DEFAULT_MAX_NUM_LEN
Since
2.16
DEFAULT_MAX_STRING_LENback to summary
public static final int DEFAULT_MAX_STRING_LEN

Default setting for maximum string length: see Builder#maxStringLength(int) for details.

Note

Jackson 2.15.0 initially used a lower setting (5_000_000).

DEFAULT_MAX_TOKEN_COUNTback to summary
public static final long DEFAULT_MAX_TOKEN_COUNT

Default setting for maximum token count: see Builder#maxTokenCount for details.

MAX_BIGINT_SCALE_MAGNITUDEback to summary
private static final int MAX_BIGINT_SCALE_MAGNITUDE

Limit for the maximum magnitude of Scale of java.math.BigDecimal that can be converted to java.math.BigInteger.

"100k digits ought to be enough for anybody!"

serialVersionUIDback to summary
private static final long serialVersionUID

Constructor Detail

StreamReadConstraintsback to summary
protected StreamReadConstraints(final int maxNestingDepth, final long maxDocLen, final int maxNumLen, final int maxStringLen)

Deprecated

Annotations
@Deprecated
StreamReadConstraintsback to summary
protected StreamReadConstraints(final int maxNestingDepth, final long maxDocLen, final int maxNumLen, final int maxStringLen, final int maxNameLen)

Deprecated

Parameters
maxNestingDepth:int

Maximum input document nesting to allow

maxDocLen:long

Maximum input document length to allow

maxNumLen:int

Maximum number representation length to allow

maxStringLen:int

Maximum String value length to allow

maxNameLen:int

Maximum Object property name length to allow

Annotations
@Deprecated
Since
2.16
StreamReadConstraintsback to summary
protected StreamReadConstraints(final int maxNestingDepth, final long maxDocLen, final int maxNumLen, final int maxStringLen, final int maxNameLen, final long maxTokenCount)
Parameters
maxNestingDepth:int

Maximum input document nesting to allow

maxDocLen:long

Maximum input document length to allow

maxNumLen:int

Maximum number representation length to allow

maxStringLen:int

Maximum String value length to allow

maxNameLen:int

Maximum Object property name length to allow

maxTokenCount:long

Maximum number of tokens to allow

Since
2.18

Method Detail

_constrainRefback to summary
protected String _constrainRef(String method)
_constructExceptionback to summary
protected StreamConstraintsException _constructException(String msgTemplate, Object... args) throws StreamConstraintsException
builderback to summary
public static StreamReadConstraints.Builder builder()
defaultsback to summary
public static StreamReadConstraints defaults()
Returns:StreamReadConstraints

the default StreamReadConstraints (when none is set on the JsonFactory explicitly)

See Also
overrideDefaultStreamReadConstraints
getMaxDocumentLengthback to summary
public long getMaxDocumentLength()

Accessor for maximum document length. see Builder#maxDocumentLength(long) for details.

Returns:long

Maximum allowed depth

getMaxNameLengthback to summary
public int getMaxNameLength()

Accessor for maximum length of names to decode. see Builder#maxNameLength(int) for details.

Returns:int

Maximum allowed name length

getMaxNestingDepthback to summary
public int getMaxNestingDepth()

Accessor for maximum depth. see Builder#maxNestingDepth(int) for details.

Returns:int

Maximum allowed depth

getMaxNumberLengthback to summary
public int getMaxNumberLength()

Accessor for maximum length of numbers to decode. see Builder#maxNumberLength(int) for details.

Returns:int

Maximum allowed number length

getMaxStringLengthback to summary
public int getMaxStringLength()

Accessor for maximum length of strings to decode. see Builder#maxStringLength(int) for details.

Returns:int

Maximum allowed string length

getMaxTokenCountback to summary
public long getMaxTokenCount()

Accessor for maximum token count. see Builder#maxTokenCount(long) for details.

Returns:long

Maximum allowed token count

Since
2.18
hasMaxDocumentLengthback to summary
public boolean hasMaxDocumentLength()

Convenience method, basically same as: 

  getMaxDocumentLength() > 0L
Returns:boolean

True if this constraints instance has a limit for maximum document length to enforce; false otherwise.

hasMaxTokenCountback to summary
public boolean hasMaxTokenCount()

Convenience method, basically same as: 

  getMaxTokenCount() > 0L
Returns:boolean

True if this constraints instance has a limit for maximum token count to enforce; false otherwise.

Since
2.18
overrideDefaultStreamReadConstraintsback to summary
public static void overrideDefaultStreamReadConstraints(final StreamReadConstraints streamReadConstraints)

Override the default StreamReadConstraints. These defaults are only used when JsonFactory instances are not configured with their own StreamReadConstraints.

Library maintainers should not set this as it will affect other code that uses Jackson. Library maintainers who want to configure StreamReadConstraints for the Jackson usage within their lib should create ObjectMapper instances that have a JsonFactory instance with the required StreamReadConstraints.

This method is meant for users delivering applications. If they use this, they set it when they start their application to avoid having other code initialize their mappers before the defaults are overridden.

Parameters
streamReadConstraints:StreamReadConstraints

new default for StreamReadConstraints (a null value will reset to built-in default)

Since
v2.15.2
See Also
defaults(), builder()
rebuildback to summary
public StreamReadConstraints.Builder rebuild()
Returns:StreamReadConstraints.Builder

New Builder initialized with settings of this constraints instance

validateBigIntegerScaleback to summary
public void validateBigIntegerScale(int scale) throws StreamConstraintsException

Convenience method that can be used to verify that a conversion to java.math.BigInteger StreamConstraintsException is thrown.

Parameters
scale:int

Scale (possibly negative) of java.math.BigDecimal to convert

Exceptions
StreamConstraintsException:
If magnitude (absolute value) of scale exceeds maximum allowed
validateDocumentLengthback to summary
public void validateDocumentLength(long len) throws StreamConstraintsException

Convenience method that can be used to verify that the document length does not exceed the maximum specified by this constraints object (if any): if it does, a StreamConstraintsException is thrown.

Parameters
len:long

Current length of processed document content

Exceptions
StreamConstraintsException:
If length exceeds maximum
Since
2.16
validateFPLengthback to summary
public void validateFPLength(int length) throws StreamConstraintsException

Convenience method that can be used to verify that a floating-point number of specified length does not exceed maximum specified by this constraints object: if it does, a StreamConstraintsException is thrown.

Parameters
length:int

Length of number in input units

Exceptions
StreamConstraintsException:
If length exceeds maximum
validateIntegerLengthback to summary
public void validateIntegerLength(int length) throws StreamConstraintsException

Convenience method that can be used to verify that an integer number of specified length does not exceed maximum specific by this constraints object: if it does, a StreamConstraintsException is thrown.

Parameters
length:int

Length of number in input units

Exceptions
StreamConstraintsException:
If length exceeds maximum
validateNameLengthback to summary
public void validateNameLength(int length) throws StreamConstraintsException

Convenience method that can be used to verify that a name of specified length does not exceed maximum specific by this constraints object: if it does, a StreamConstraintsException is thrown.

Parameters
length:int

Length of name in input units

Exceptions
StreamConstraintsException:
If length exceeds maximum
validateNestingDepthback to summary
public void validateNestingDepth(int depth) throws StreamConstraintsException

Convenience method that can be used to verify that the nesting depth does not exceed the maximum specified by this constraints object: if it does, a StreamConstraintsException is thrown.

Parameters
depth:int

count of unclosed objects and arrays

Exceptions
StreamConstraintsException:
If depth exceeds maximum
validateStringLengthback to summary
public void validateStringLength(int length) throws StreamConstraintsException

Convenience method that can be used to verify that a String of specified length does not exceed maximum specific by this constraints object: if it does, a StreamConstraintsException is thrown.

Parameters
length:int

Length of string in input units

Exceptions
StreamConstraintsException:
If length exceeds maximum
validateTokenCountback to summary
public void validateTokenCount(long count) throws StreamConstraintsException

Convenience method that can be used to verify that the token count does not exceed the maximum specified by this constraints object (if any): if it does, a StreamConstraintsException is thrown.

Parameters
count:long

Current token count for processed document content

Exceptions
StreamConstraintsException:
If length exceeds maximum
Since
2.18
com.fasterxml.jackson.core back to summary

public final Class StreamReadConstraints.Builder

extends Object
Class Inheritance

Field Summary

Modifier and TypeField and Description
private long
maxDocLen

private int
maxNameLen

private int
maxNestingDepth

private int
maxNumLen

private int
maxStringLen

private long
maxTokenCount

Constructor Summary

AccessConstructor and Description
pack-priv
Builder()

pack-priv
Builder(final int maxNestingDepth, final long maxDocLen, final long maxTokenCount, final int maxNumLen, final int maxStringLen, final int maxNameLen)

pack-priv
Builder(StreamReadConstraints src)

Method Summary

Modifier and TypeMethod and Description
public StreamReadConstraints
build()

public StreamReadConstraints.Builder

Returns:

this builder
maxDocumentLength(long
the maximum allowed document length if positive number above 0; otherwise (0 or negative number) means "unlimited".
maxDocLen)

Sets the maximum allowed document length (for positive values over 0) or indicate that any length is acceptable (0 or negative number).

public StreamReadConstraints.Builder

Returns:

this builder
maxNameLength(final int
the maximum string length (in chars or bytes, depending on input context)
maxNameLen)

Sets the maximum name length (in chars or bytes, depending on input context).

public StreamReadConstraints.Builder

Returns:

this builder
maxNestingDepth(final int
the maximum depth
maxNestingDepth)

Sets the maximum nesting depth.

public StreamReadConstraints.Builder

Returns:

this builder
maxNumberLength(final int
the maximum number length (in chars or bytes, depending on input context)
maxNumLen)

Sets the maximum number length (in chars or bytes, depending on input context).

public StreamReadConstraints.Builder

Returns:

this builder
maxStringLength(final int
the maximum string length (in chars or bytes, depending on input context)
maxStringLen)

Sets the maximum string length (in chars or bytes, depending on input context).

public StreamReadConstraints.Builder

Returns:

this builder
maxTokenCount(long
the maximum allowed token count if positive number above 0; otherwise (0 or negative number) means "unlimited".
maxTokenCount)

Sets the maximum allowed token count (for positive values over 0) or indicate that any count is acceptable (0 or negative number).

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

maxDocLenback to summary
private long maxDocLen
maxNameLenback to summary
private int maxNameLen
maxNestingDepthback to summary
private int maxNestingDepth
maxNumLenback to summary
private int maxNumLen
maxStringLenback to summary
private int maxStringLen
maxTokenCountback to summary
private long maxTokenCount

Constructor Detail

Builderback to summary
pack-priv Builder()
Builderback to summary
pack-priv Builder(final int maxNestingDepth, final long maxDocLen, final long maxTokenCount, final int maxNumLen, final int maxStringLen, final int maxNameLen)
Builderback to summary
pack-priv Builder(StreamReadConstraints src)

Method Detail

buildback to summary
public StreamReadConstraints build()
maxDocumentLengthback to summary
public StreamReadConstraints.Builder maxDocumentLength(long maxDocLen)

Sets the maximum allowed document length (for positive values over 0) or indicate that any length is acceptable (0 or negative number). The length is in input units of the input source, that is, in bytes or chars.

Parameters
maxDocLen:long

the maximum allowed document length if positive number above 0; otherwise (0 or negative number) means "unlimited".

Returns:StreamReadConstraints.Builder

this builder

Since
2.16
maxNameLengthback to summary
public StreamReadConstraints.Builder maxNameLength(final int maxNameLen)

Sets the maximum name length (in chars or bytes, depending on input context). The default is 50,000. This limit is not exact, the limit is applied when we increase internal buffer sizes and an exception will happen at sizes greater than this limit. Some text values that are a little bigger than the limit may be treated as valid but no text values with sizes less than or equal to this limit will be treated as invalid.

Parameters
maxNameLen:int

the maximum string length (in chars or bytes, depending on input context)

Returns:StreamReadConstraints.Builder

this builder

Exceptions
IllegalArgumentException:
if the maxStringLen is set to a negative value
Since
2.16.0
maxNestingDepthback to summary
public StreamReadConstraints.Builder maxNestingDepth(final int maxNestingDepth)

Sets the maximum nesting depth. The depth is a count of objects and arrays that have not been closed, `{` and `[` respectively.

Parameters
maxNestingDepth:int

the maximum depth

Returns:StreamReadConstraints.Builder

this builder

Exceptions
IllegalArgumentException:
if the maxNestingDepth is set to a negative value
maxNumberLengthback to summary
public StreamReadConstraints.Builder maxNumberLength(final int maxNumLen)

Sets the maximum number length (in chars or bytes, depending on input context). The default is 1000.

Parameters
maxNumLen:int

the maximum number length (in chars or bytes, depending on input context)

Returns:StreamReadConstraints.Builder

this builder

Exceptions
IllegalArgumentException:
if the maxNumLen is set to a negative value
maxStringLengthback to summary
public StreamReadConstraints.Builder maxStringLength(final int maxStringLen)

Sets the maximum string length (in chars or bytes, depending on input context). The default is 20,000,000. This limit is not exact, the limit is applied when we increase internal buffer sizes and an exception will happen at sizes greater than this limit. Some text values that are a little bigger than the limit may be treated as valid but no text values with sizes less than or equal to this limit will be treated as invalid.

Setting this value to lower than the maxNumberLength(int) is not recommended.

Note

Jackson 2.15.0 initially used a lower setting (5_000_000).

Parameters
maxStringLen:int

the maximum string length (in chars or bytes, depending on input context)

Returns:StreamReadConstraints.Builder

this builder

Exceptions
IllegalArgumentException:
if the maxStringLen is set to a negative value
maxTokenCountback to summary
public StreamReadConstraints.Builder maxTokenCount(long maxTokenCount)

Sets the maximum allowed token count (for positive values over 0) or indicate that any count is acceptable (0 or negative number).

A token is a single unit of input, such as a number, a string, an object start or end, or an array start or end.

Parameters
maxTokenCount:long

the maximum allowed token count if positive number above 0; otherwise (0 or negative number) means "unlimited".

Returns:StreamReadConstraints.Builder

this builder

Since
2.18