ViewVC Help
View File | Revision Log | Show Annotations | Download File
/cvs/JSON-XS/XS.pm
(Generate patch)

Comparing JSON-XS/XS.pm (file contents):
Revision 1.46 by root, Mon Jun 25 04:21:14 2007 UTC vs.
Revision 1.47 by root, Mon Jun 25 06:57:42 2007 UTC

… …
393given character in a string. 393given character in a string.
394 394
395Setting the maximum depth to one disallows any nesting, so that ensures 395Setting the maximum depth to one disallows any nesting, so that ensures
396that the object is only a single hash/object or array. 396that the object is only a single hash/object or array.
397 397
398The argument to C<max_depth> will be rounded up to the next nearest power 398The argument to C<max_depth> will be rounded up to the next highest power
399of two. 399of two. If no argument is given, the highest possible setting will be
400used, which is rarely useful.
401
402See SECURITY CONSIDERATIONS, below, for more info on why this is useful.
403
404=item $json = $json->max_size ([$maximum_string_size])
405
406Set the maximum length a JSON text may have (in bytes) where decoding is
407being attempted. The default is C<0>, meaning no limit. When C<decode>
408is called on a string longer then this number of characters it will not
409attempt to decode the string but throw an exception. This setting has no
410effect on C<encode> (yet).
411
412The argument to C<max_size> will be rounded up to the next B<highest>
413power of two (so may be more than requested). If no argument is given, the
414limit check will be deactivated (same as when C<0> is specified).
400 415
401See SECURITY CONSIDERATIONS, below, for more info on why this is useful. 416See SECURITY CONSIDERATIONS, below, for more info on why this is useful.
402 417
403=item $json_text = $json->encode ($perl_scalar) 418=item $json_text = $json->encode ($perl_scalar)
404 419
… …
752Second, you need to avoid resource-starving attacks. That means you should 767Second, you need to avoid resource-starving attacks. That means you should
753limit the size of JSON texts you accept, or make sure then when your 768limit the size of JSON texts you accept, or make sure then when your
754resources run out, thats just fine (e.g. by using a separate process that 769resources run out, thats just fine (e.g. by using a separate process that
755can crash safely). The size of a JSON text in octets or characters is 770can crash safely). The size of a JSON text in octets or characters is
756usually a good indication of the size of the resources required to decode 771usually a good indication of the size of the resources required to decode
757it into a Perl structure. 772it into a Perl structure. While JSON::XS can check the size of the JSON
773text, it might be too late when you already have it in memory, so you
774might want to check the size before you accept the string.
758 775
759Third, JSON::XS recurses using the C stack when decoding objects and 776Third, JSON::XS recurses using the C stack when decoding objects and
760arrays. The C stack is a limited resource: for instance, on my amd64 777arrays. The C stack is a limited resource: for instance, on my amd64
761machine with 8MB of stack size I can decode around 180k nested arrays but 778machine with 8MB of stack size I can decode around 180k nested arrays but
762only 14k nested JSON objects (due to perl itself recursing deeply on croak 779only 14k nested JSON objects (due to perl itself recursing deeply on croak

Diff Legend

– Removed lines
+ Added lines
< Changed lines
> Changed lines