JsonValueWriter can throw StackOverflowError on deeply nested items by nosan · Pull Request #44627 · spring-projects/spring-boot

nosan · 2025-03-06T14:42:28Z

Related to #44502

By default, Jackson uses a nesting depth of 1000.

Jackson:

	@Test
	void jackson() throws JsonProcessingException {
		List<Object> list = new ArrayList<>();
		list.add(list);
		new ObjectMapper().writeValueAsString(list);
	}

Document nesting depth (1001) exceeds the maximum allowed (1000, from `StreamWriteConstraints.getMaxNestingDepth()`) (through reference chain: java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->java.util.ArrayList[0]->

If you configure Jackson with a nesting depth greater than 1000 (Integer.MAX_VALUE), a StackOverflowError will also be thrown.

Jackson nestingDepth=5000

	@Test
	void jackson() throws JsonProcessingException {
		StreamWriteConstraints
			.overrideDefaultStreamWriteConstraints(StreamWriteConstraints.builder().maxNestingDepth(5000).build());
		List<Object> list = new ArrayList<>();
		list.add(list);
		ObjectMapper objectMapper = new ObjectMapper();
		objectMapper.writeValueAsString(list);
	}

java.lang.StackOverflowError
	at com.fasterxml.jackson.databind.ser.impl.IndexedListSerializer.serialize(IndexedListSerializer.java:69)
	at com.fasterxml.jackson.databind.ser.impl.IndexedListSerializer.serialize(IndexedListSerializer.java:18)
	at com.fasterxml.jackson.databind.ser.impl.IndexedListSerializer.serializeContents(IndexedListSerializer.java:119)
	at com.fasterxml.jackson.databind.ser.impl.IndexedListSerializer.serialize(IndexedListSerializer.java:79)
	at com.fasterxml.jackson.databind.ser.impl.IndexedListSerializer.serialize(IndexedListSerializer.java:18)
	at com.fasterxml.jackson.databind.ser.impl.IndexedListSerializer.serializeContents(IndexedListSerializer.java:119)
	at com.fasterxml.jackson.databind.ser.impl.IndexedListSerializer.serialize(IndexedListSerializer.java:79)
	at com.fasterxml.jackson.databind.ser.impl.IndexedListSerializer.serialize(IndexedListSerializer.java:18)

Gson:

@Test
void gson() {
		List<Object> list = new ArrayList<>();
		list.add(list);
		new Gson().toJson(list);
}


java.lang.StackOverflowError
	at com.google.gson.internal.$Gson$Types.equals($Gson$Types.java:175)
	at com.google.gson.reflect.TypeToken.equals(TypeToken.java:346)
	at java.base/java.util.concurrent.ConcurrentHashMap.get(ConcurrentHashMap.java:940)
	at com.google.gson.Gson.getAdapter(Gson.java:600)
	at com.google.gson.internal.bind.TypeAdapterRuntimeTypeWrapper.write(TypeAdapterRuntimeTypeWrapper.java:57)
	at com.google.gson.internal.bind.CollectionTypeAdapterFactory$Adapter.write(CollectionTypeAdapterFactory.java:99)
	at com.google.gson.internal.bind.CollectionTypeAdapterFactory$Adapter.write(CollectionTypeAdapterFactory.java:59)
	at com.google.gson.internal.bind.TypeAdapterRuntimeTypeWrapper.write(TypeAdapterRuntimeTypeWrapper.java:73)
	at com.google.gson.internal.bind.CollectionTypeAdapterFactory$Adapter.write(CollectionTypeAdapterFactory.java:99)

Jsonb:

@Test
void jsonb() {
  List<Object> list = new ArrayList<>();
  list.add(list);
  JsonbBuilder.create().toJson(list);
}

SEVERE: Generating incomplete JSON

java.lang.StackOverflowError
	at java.base/java.lang.Class.reflectionData(Class.java:3214)
	at java.base/java.lang.Class.getInterfaces(Class.java:1144)
	at java.base/java.lang.Class.getInterfaces(Class.java:1140)
	at org.eclipse.yasson.internal.ComponentMatcher.searchComponentBinding(ComponentMatcher.java:210)
	at org.eclipse.yasson.internal.ComponentMatcher.getSerializerBinding(ComponentMatcher.java:145)
	at org.eclipse.yasson.internal.serializer.SerializationModelCreator.userSerializer(SerializationModelCreator.java:418)
	at org.eclipse.yasson.internal.serializer.SerializationModelCreator.serializerChainInternal(SerializationModelCreator.java:149)
	at org.eclipse.yasson.internal.serializer.SerializationModelCreator.serializerChain(SerializationModelCreator.java:133)
	at org.eclipse.yasson.internal.serializer.SerializationModelCreator.serializerChain(SerializationModelCreator.java:91)

nosan · 2025-03-06T16:19:33Z

Oh... with private static final int MAX_NESTING_DEPTH = 1000, the tests fail on CI: 😞

Expecting actual throwable to be an instance of:
  java.lang.IllegalStateException
but was:
  java.lang.StackOverflowError
	at org.springframework.boot.json.JsonWriter$MemberPath.toString(JsonWriter.java:816)
	at org.springframework.boot.json.JsonWriter$MemberPath.toString(JsonWriter.java:816)
	at org.springframework.boot.json.JsonWriter$MemberPath.toString(JsonWriter.java:816)

nosan · 2025-03-06T16:43:01Z

...ng-boot-project/spring-boot/src/main/java/org/springframework/boot/json/JsonValueWriter.java

 */
 class JsonValueWriter {

+	private static final int DEFAULT_MAX_NESTING_DEPTH = 1000;


I'm wondering if such a deep nesting level is necessary, as JsonWriter is primarily used for StructuredLogging, and such depth seems practically impossible.

Maybe this should be configurable? If user decides they want more, they should be able to get more. Default level should be maybe lower, something like 32. Note that this is not only a stack-overflow protection, but also protection against overflowing the storage space for logs.

I've prototyped some changes main...nosan:44502-json-writer-configuration

This commit adds validation for the maximum JSON nesting depth in the JsonValueWriter. This helps prevent StackOverflowError that can potentially occur due to excessive recursion when dealing with deeply nested JSON structures. Signed-off-by: Dmytro Nosan <dimanosan@gmail.com>

Add validation for the maximum JSON nesting depth in the JsonValueWriter. This helps prevent a StackOverflowError that can potentially occur due to excessive recursion when dealing with deeply nested JSON structures. See gh-44627 Signed-off-by: Dmytro Nosan <dimanosan@gmail.com>

See gh-44627

philwebb · 2025-04-23T03:02:00Z

Thanks for the PR @nosan and for the review @thecooldrop! I've gone with a max depth of 500 and I think we should leave it without a configuration option unless we find it causes problems.

spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Mar 6, 2025

nosan force-pushed the 44502-stackoverflow-protection branch 2 times, most recently from b3f8244 to ea08a97 Compare March 6, 2025 15:21

nosan mentioned this pull request Mar 6, 2025

Logging a Path object using structured logging throws StackOverflowError #44502

Closed

nosan force-pushed the 44502-stackoverflow-protection branch from 6849356 to 1777be4 Compare March 6, 2025 16:27

nosan commented Mar 6, 2025

View reviewed changes

nosan force-pushed the 44502-stackoverflow-protection branch from 1777be4 to e36455c Compare April 17, 2025 15:54

philwebb added type: bug A general bug and removed status: waiting-for-triage An issue we've not yet triaged labels Apr 23, 2025

philwebb added this to the 3.4.5 milestone Apr 23, 2025

philwebb self-assigned this Apr 23, 2025

philwebb changed the title ~~Add protection against StackOverflowError in JsonValueWriter~~ JsonValueWriter can throw StackOverflowError on deeply nested items Apr 23, 2025

philwebb mentioned this pull request Apr 23, 2025

JsonValueWriter can throw StackOverflowError on deeply nested items #45262

Closed

philwebb added a commit that referenced this pull request Apr 23, 2025

Polish 'Protected against JsonValueWriter stack overflow'

4b607bd

See gh-44627

philwebb closed this in 80632bd Apr 23, 2025

Netyyyy mentioned this pull request Apr 30, 2025

External dependencies upgrade - Spring Boot 3.4.5 and Spring Cloud 2024.0.1 Azure/azure-sdk-for-java#45172

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

JsonValueWriter can throw StackOverflowError on deeply nested items#44627

JsonValueWriter can throw StackOverflowError on deeply nested items#44627
nosan wants to merge 1 commit intospring-projects:3.4.xfrom
nosan:44502-stackoverflow-protection

nosan commented Mar 6, 2025 •

edited

Loading

Uh oh!

nosan commented Mar 6, 2025 •

edited

Loading

Uh oh!

nosan Mar 6, 2025

Uh oh!

thecooldrop Mar 9, 2025

Uh oh!

nosan Mar 10, 2025

Uh oh!

philwebb commented Apr 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

nosan commented Mar 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nosan commented Mar 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nosan Mar 6, 2025

Choose a reason for hiding this comment

Uh oh!

thecooldrop Mar 9, 2025

Choose a reason for hiding this comment

Uh oh!

nosan Mar 10, 2025

Choose a reason for hiding this comment

Uh oh!

philwebb commented Apr 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

nosan commented Mar 6, 2025 •

edited

Loading

nosan commented Mar 6, 2025 •

edited

Loading