Disable Jackson default JSON processing limits#17854
Merged
findepi merged 1 commit intotrinodb:masterfrom Jun 21, 2023
Merged
Conversation
Contributor
Author
|
I tried to create smallest change possible |
electrum
approved these changes
Jun 12, 2023
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/JsonTypeUtil.java
Outdated
Show resolved
Hide resolved
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/JsonUtils.java
Outdated
Show resolved
Hide resolved
wendigo
force-pushed
the
serafin/json-factory-ban
branch
from
bcd058c to
5abda7b
Compare
findepi
reviewed
Jun 12, 2023
findepi
reviewed
Jun 12, 2023
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/DefaultJsonFactory.java
Outdated
Show resolved
Hide resolved
findepi
reviewed
Jun 12, 2023
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/DefaultJsonFactory.java
Outdated
Show resolved
Hide resolved
findepi
reviewed
Jun 12, 2023
service/trino-verifier/src/main/java/io/trino/verifier/JsonEventClient.java
Outdated
Show resolved
Hide resolved
wendigo
force-pushed
the
serafin/json-factory-ban
branch
3 times, most recently
from
f8f79a5 to
e6ee843
Compare
hashhar
approved these changes
Jun 13, 2023
Member
hashhar
left a comment
hashhar
left a comment
There was a problem hiding this comment.
Looks good % comments.
re: allowing default factory on serialization paths - we won't know when code is introduced in the serialization places which also does de-serialization. Why not use the no-limits JsonFactory in serialization path as well - doesn't seem to hurt?
testing/trino-benchmark/src/main/java/io/trino/benchmark/JsonBenchmarkResultWriter.java
Outdated
Show resolved
Hide resolved
testing/trino-benchmark/src/main/java/io/trino/benchmark/OdsBenchmarkResultWriter.java
Outdated
Show resolved
Hide resolved
wendigo
force-pushed
the
serafin/json-factory-ban
branch
from
e6ee843 to
3483904
Compare
kokosing
reviewed
Jun 13, 2023
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/DefaultJsonFactory.java
Outdated
Show resolved
Hide resolved
lib/trino-hive-formats/src/main/java/io/trino/hive/formats/line/json/JsonSerializer.java
Outdated
Show resolved
Hide resolved
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/DefaultJsonFactory.java
Outdated
Show resolved
Hide resolved
core/trino-main/src/main/java/io/trino/operator/scalar/JsonExtract.java
Outdated
Show resolved
Hide resolved
plugin/trino-iceberg/src/main/java/io/trino/plugin/iceberg/PartitionData.java
Outdated
Show resolved
Hide resolved
wendigo
force-pushed
the
serafin/json-factory-ban
branch
from
3483904 to
c340024
Compare
hashhar
approved these changes
Jun 14, 2023
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/TrinoJsonFactory.java
Outdated
Show resolved
Hide resolved
kokosing
approved these changes
Jun 14, 2023
wendigo
force-pushed
the
serafin/json-factory-ban
branch
from
c340024 to
d723f00
Compare
Member
|
added "Fixes #17843" in the description |
findepi
requested changes
Jun 14, 2023
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/TrinoJsonFactory.java
Outdated
Show resolved
Hide resolved
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/TrinoJsonFactory.java
Outdated
Show resolved
Hide resolved
losipiuk
reviewed
Jun 19, 2023
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/TrinoJsonFactory.java
Outdated
Show resolved
Hide resolved
Member
|
#17854 (comment) is resolved, please help me understand what the resolution is. |
Contributor
Author
|
@findepi disallow mutating already configured JsonFacfory. Instead you should use a builder if you want a different configuration. This makes it easier to reason about factories that are used since they configuration is immutable in the runtime |
findepi
reviewed
Jun 21, 2023
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/TrinoJsonFactory.java
Outdated
Show resolved
Hide resolved
wendigo
force-pushed
the
serafin/json-factory-ban
branch
2 times, most recently
from
82e38e3 to
e27855f
Compare
Contributor
Author
findepi
reviewed
Jun 21, 2023
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/TrinoJsonFactory.java
Outdated
Show resolved
Hide resolved
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/TrinoJsonFactory.java
Outdated
Show resolved
Hide resolved
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/TrinoJsonFactory.java
Outdated
Show resolved
Hide resolved
wendigo
force-pushed
the
serafin/json-factory-ban
branch
from
e27855f to
5a4aac1
Compare
findepi
reviewed
Jun 21, 2023
Member
findepi
left a comment
findepi
left a comment
There was a problem hiding this comment.
"Provide safe way to create JsonFactories"
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/JsonUtils.java
Outdated
Show resolved
Hide resolved
lib/trino-plugin-toolkit/src/test/java/io/trino/plugin/base/util/TestJsonUtils.java
Outdated
Show resolved
Hide resolved
lib/trino-plugin-toolkit/src/test/java/io/trino/plugin/base/util/TestJsonUtils.java
Outdated
Show resolved
Hide resolved
lib/trino-plugin-toolkit/src/test/java/io/trino/plugin/base/util/TestJsonUtils.java
Outdated
Show resolved
Hide resolved
lib/trino-plugin-toolkit/src/test/java/io/trino/plugin/base/util/TestJsonUtils.java
Outdated
Show resolved
Hide resolved
findepi
reviewed
Jun 21, 2023
Member
|
lgtm % |
wendigo
force-pushed
the
serafin/json-factory-ban
branch
from
5a4aac1 to
a9dbb01
Compare
findepi
approved these changes
Jun 21, 2023
lib/trino-plugin-toolkit/src/main/java/io/trino/plugin/base/util/JsonUtils.java
Outdated
Show resolved
Hide resolved
Member
|
CI checkstyle failure looks related |
wendigo
force-pushed
the
serafin/json-factory-ban
branch
2 times, most recently
from
b929265 to
48e5c93
Compare
kokosing
approved these changes
Jun 21, 2023
Jackson 2.15 introduced read constraints that are meant to protect deserialization path from deeply nested/long string JSON documents. Introduced limits are too small for Trino to work properly. Airlift is already disabling those limits when ObjectMapperProvider is used. Additionaly ban direct usage of JsonFactory and JsonFactoryBuilder. Instead JsonUtils.jsonFactory() or JsonUtils.jsonFactoryBuilder() should be used.
findepi
changed the title
findepi
force-pushed
the
serafin/json-factory-ban
branch
from
48e5c93 to
89c61de
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Additional context and related issues
Release notes
( ) This is not user-visible or docs only and no release notes are required.
( ) Release notes are required, please propose a release note for me.
( ) Release notes are required, with the following suggested text:
Fixes #17843