Skip to content

[THRIFT-5916] Enforce recursion depth limit in Java for C++ parity - #3287

Merged
mhlakhani merged 1 commit into
apache:masterfrom
mhlakhani:fix-java-recursion-depth-limit
Jan 26, 2026
Merged

[THRIFT-5916] Enforce recursion depth limit in Java for C++ parity#3287
mhlakhani merged 1 commit into
apache:masterfrom
mhlakhani:fix-java-recursion-depth-limit

Conversation

@mhlakhani

Copy link
Copy Markdown
Contributor

Java had TConfiguration.recursionLimit (default 64) and TProtocolException.DEPTH_LIMIT defined but the limit was not actually enforced during struct deserialization. This brings Java in line with C++ which already enforces recursion limits.

Changes:

  • Add recursionDepth_ counter and increment/decrement methods to TProtocol
  • Modify Java code generator to emit try-finally depth tracking in generate_standard_reader() and generate_java_struct_tuple_reader()

Structures exceeding the configured recursion limit now throw TProtocolException(DEPTH_LIMIT) during deserialization.

  • Did you create an Apache Jira ticket? (Request account here, not required for trivial changes)
  • If a ticket exists: Does your pull request title follow the pattern "THRIFT-NNNN: describe my issue"?
  • Did you squash your changes to a single commit? (not required, but preferred)
  • Did you do your best to avoid breaking changes? If one was needed, did you label the Jira ticket with "Breaking-Change"?
  • If your change does not involve any code, include [skip ci] anywhere in the commit message to free up build resources.

@mergeablemergeableBot added java Pull requests that update Java code compiler labels Jan 26, 2026
Java had TConfiguration.recursionLimit (default 64) and
TProtocolException.DEPTH_LIMIT defined but the limit was not actually
enforced during struct deserialization. This brings Java in line with
C++ which already enforces recursion limits.
Changes:
- Add recursionDepth_ counter and increment/decrement methods to TProtocol
- Modify Java code generator to emit try-finally depth tracking in
generate_standard_reader() and generate_java_struct_tuple_reader()
Structures exceeding the configured recursion limit now throw
TProtocolException(DEPTH_LIMIT) during deserialization.
@mhlakhani
mhlakhaniforce-pushed the fix-java-recursion-depth-limit branch from fab9adf to a7e6fcaCompareJanuary 26, 2026 05:51
@mhlakhani
mhlakhani merged commit 10d9272 into apache:masterJan 26, 2026
38 checks passed
ikhoon pushed a commit to line/armeria that referenced this pull request May 20, 2026
Motivation:
Thrift 0.23.0 has been released, with some breaking changes:
- apache/thrift#3287
- apache/thrift#3334
Modifications:
- Add the `thrift0.23` module
- Update `TByteBufTransport` to return a default `TConfiguration`, to
handle the first breaking change
- Add `ThriftProtocolDecorator` to help with the migration to resolve
the second breaking change
- Add `TProtocolDecorationException` to handle new errors
Result:
- Armeria supports Thrift 0.23.0
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

compilerjavaPull requests that update Java code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@mhlakhani