Scan: a ScanFilter value nested 32 levels deep is accepted; the service refuses it with the nesting text

未关闭 适合新手
  • 哪里不对？
#721 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 4 天内回复

还没有人认领这个 Issue。

评估

难度
2/5
预计耗时
1-3 小时
新手友好度
72/100
Issue 类型
缺陷
描述清晰度
描述清楚
活跃度
活跃
技术栈
rust
领域
backend

调研方向

从 crates/engine/src/scan.rs 中 handle_scan 的 ScanFilter 分支（约第 124 行）开始阅读，然后查看 crates/engine/src/legacy_filter.rs 中的 desugar_filter（约第 332 行），了解 AttributeValueList 的值在哪里被复制。现有的深度检查是 crates/core/src/validation 中的 validate_attribute_values_nesting_depth，被 put_item.rs、update_item.rs 和 delete_item.rs 使用。完成标准是：嵌套 32 层的 ScanFilter 值返回嵌套相关的 ValidationException，而 31 层仍然通过。

由索引模型根据 Issue 内容生成。

描述

A ScanFilter whose AttributeValueList holds a value nested 32 levels deep is accepted and the scan runs. The service refuses the request with the nesting text it uses for ExpressionAttributeValues and for items.

Measured against Amazon DynamoDB in us-east-1 on 31 October 2026, each request twice, both answers identical. Table pk S HASH, sk S RANGE, items p0/s1 (a 1), p0/s2 (a 2) and p1/s1 (a 3). ExtendDB answers are from main f49c5f823 (SQLite, release build), each request twice, both answers identical.

Request Service ExtendDB main f49c5f823
Scan, "ScanFilter": {"a": {"ComparisonOperator": "EQ", "AttributeValueList": [v]}} with v = {"N": "1"} inside 32 nested L values ValidationException: Nesting Levels have exceeded supported limits: Attributes in the item have nested levels beyond supported limit 200, Count 0, ScannedCount 3
the same with 31 nested L values not sent to the service 200, Count 0, ScannedCount 3

For comparison, the same value in ExpressionAttributeValues of a Scan with a FilterExpression answers the nesting text on the service from 32 levels and passes at 31 (measured 30 and 31 October 2026, #564). The fix for #564 adds that check for ExpressionAttributeValues on Scan and still answers the ScanFilter request above with 200, as main does.

Where the answer comes from

crates/engine/src/scan.rs, handle_scan: the ScanFilter arm at line 124 passes the map to desugar_filter (crates/engine/src/legacy_filter.rs, line 332), which builds the filter expression and its value map from the AttributeValueList entries. No call checks the depth of those values. The depth check the engine uses for items and for the ExpressionAttributeValues of PutItem, UpdateItem and DeleteItem is validate_attribute_values_nesting_depth in crates/core/src/validation (put_item.rs line 180, update_item.rs line 224, delete_item.rs line 96).

Related

#477 item 3: a ScanFilter EQ with an N value that is not a number answers 200 where the service reports the number text; that is the same code path with a different check missing. Whether the service checks QueryFilter and KeyConditions values the same way was not measured.

主要语言
Rust
星标
517
派生
60
平均合并
5 天 5 小时
30 天内合并 PR
41

环境准备

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

ExtendDB/extenddb 的其他 Issue

查看 ExtendDB/extenddb 的全部 Issue

相似的 Issue

更多 Rust Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。