`maxStringLength` is not enforced when skipping String values

Open
  • Is something wrong?
#1,735 2 comments 0 reactions 1 assignee View on GitHub

Maintainers usually reply within 1 day

@Dongnyoung is already working on this.

Since Oct 5, 2026.

  • #1736 by @Dongnyoung — open

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
75/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
java
Domain
backend

Research direction

Compare the _skipString() paths in ReaderBasedJsonParser, UTF8StreamJsonParser, and UTF8DataInputJsonParser with the async parser's existing enforcement. Trace how maxStringLength is checked when strings are materialized, then verify that skipped oversized strings are rejected in each synchronous parser. Done when the example with a 100,000-character string and a 1,000-character limit fails consistently while within-limit strings still advance normally.

Written by the indexing model from the issue text.

Description

Summary

StreamReadConstraints.maxStringLength is not enforced when a String value is skipped by synchronous parsers.

When a String value is materialized, its length is validated against maxStringLength. However, if the value is left incomplete and skipped by calling nextToken(), the _skipString() paths do not track or validate the String length.

For example:

JsonFactory f = JsonFactory.builder()
        .streamReadConstraints(StreamReadConstraints.builder()
                .maxStringLength(1000)
                .build())
        .build();

JsonParser p = createParser(f, mode,
        "[\"" + "x".repeat(100_000) + "\",1]");

p.nextToken(); // START_ARRAY
p.nextToken(); // VALUE_STRING
p.nextToken(); // skips the String and advances to VALUE_NUMBER_INT

The 100,000-character String is accepted when skipped, despite the configured limit of 1,000.

This affects the synchronous String-skipping paths in:

  • ReaderBasedJsonParser
  • UTF8StreamJsonParser
  • UTF8DataInputJsonParser

The async parser already enforces the constraint while skipping the String.

This is similar to #1727: validation is performed when the String is consumed, but is missing from the corresponding skip path.

I think _skipString() should enforce maxStringLength consistently with the materialization paths.

Dominant language
Java
Stars
2.4k
Forks
952
Avg merge
3d 6h
Merged PRs (30d)
32

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from FasterXML/jackson-core

All issues in FasterXML/jackson-core

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.