Files
thrift/test/JsRecursionDepthTest.thrift
Jens GeyerandClaude Sonnet 4.6 6f6c619fee THRIFT-6046: Limit struct read/write recursion depth in JavaScript library
Client: js

The JS generator wraps each generated struct and union read/write body with
incrementRecursionDepth()/try/finally/decrementRecursionDepth() (limit
DEFAULT_RECURSION_DEPTH = 64, TProtocolException.DEPTH_LIMIT on excess) for
both lib/js (browser) and lib/nodejs. Previously only skip() was bounded.
Exceptions are generated through the same struct reader/writer, so they are
bounded too. The nodejs THeaderProtocol delegating wrapper forwards the
increment/decrement calls so generated read/write through it is also bounded.

Replace the isolated counter tests with generated-code round-trips over a
recursive struct (RecTree), union (RecUnion) and exception (RecError) from
JsRecursionDepthTest.thrift, driven through the generated read/write:
  - nodejs (lib/nodejs/test/recursion_depth.test.js, wired into testAll.sh)
    over Binary, Compact and JSON, plus a generated write through
    THeaderProtocol;
  - browser (lib/js/test/test-skip-depth.js) over Thrift.Protocol.
A chain at the limit round-trips; a chain past it is rejected with DEPTH_LIMIT
on write; a payload crafted with the guard neutralised (so the over-limit
bytes exist) is rejected on read -- crafted with the real recursive field so
the reader recurses through the guarded path rather than skip().

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-03 23:02:12 +02:00

37 lines
1.1 KiB
Thrift

/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
// Recursive types used to exercise the struct/union/exception read/write
// recursion-depth limit in the JavaScript (node) library.
struct RecTree {
1: list<RecTree> children
2: i16 item
}
union RecUnion {
1: list<RecUnion> children
2: i32 leaf
}
exception RecError {
1: list<RecError> children
2: i32 leaf
}