Skip to content

THRIFT-6045: Limit struct read/write recursion depth in Ruby library#3550

Draft
Jens-G wants to merge 1 commit into
apache:masterfrom
Jens-G:rb-recursion-depth
Draft

THRIFT-6045: Limit struct read/write recursion depth in Ruby library#3550
Jens-G wants to merge 1 commit into
apache:masterfrom
Jens-G:rb-recursion-depth

Conversation

@Jens-G
Copy link
Copy Markdown
Member

@Jens-G Jens-G commented May 28, 2026

Summary

  • Adds increment_recursion_depth / decrement_recursion_depth methods to BaseProtocol
  • Limit is 64; raises ProtocolException::DEPTH_LIMIT when exceeded
  • Struct module's read / write methods wrap the body with begin/ensure to guarantee the counter is always restored

Test plan

  • Unit tests for depth allow/reject/restore via ruby -Ilib test/unit/...
  • Cross-language tests unaffected

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.6 noreply@anthropic.com

Client: rb

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@Jens-G Jens-G requested a review from kpumuk as a code owner May 28, 2026 11:45
@mergeable mergeable Bot added the ruby Pull requests that update Ruby code label May 28, 2026
Copy link
Copy Markdown
Member

@kpumuk kpumuk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR is insufficient:

  • It only covers pure Ruby implementation, and not the native extension
  • It does not cover Union
  • There are no tests

I am currently working on https://issues.apache.org/jira/browse/THRIFT-5938, with recursion depth enforcement being a part of the problem. I can extract my change to merge it ahead of the configuration class

@Jens-G Jens-G marked this pull request as draft May 28, 2026 22:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ruby Pull requests that update Ruby code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants