As a library user I want to configure the maximum size of deserialized JSONs

[chibenwa]

Play JSON Version (2.5.x / etc)

            <dependency>
                <groupId>com.typesafe.play</groupId>
                <artifactId>play-json_${scala.base}</artifactId>
                <version>2.9.4</version>
            </dependency>

API (Scala / Java / Neither / Both)

Scala

Operating System (Ubuntu 15.10 / MacOS 10.10 / Windows 10)

Use `uname -a` if on Linux.

JDK (Oracle 1.8.0_72, OpenJDK 1.8.x, Azul Zing)

$ java -version
openjdk version "21.0.1" 2023-10-17
OpenJDK Runtime Environment (build 21.0.1+12-Ubuntu-222.04)
OpenJDK 64-Bit Server VM (build 21.0.1+12-Ubuntu-222.04, mixed mode, sharing

Expected Behavior

I ended up wioth the following exception on a production server:

com.fasterxml.jackson.core.exc.StreamConstraintsException: String length (20054016) exceeds the maximum length (20000000)
	at com.fasterxml.jackson.core.StreamReadConstraints.validateStringLength(StreamReadConstraints.java:324)
	at com.fasterxml.jackson.core.util.ReadConstrainedTextBuffer.validateStringLength(ReadConstrainedTextBuffer.java:27)
	at com.fasterxml.jackson.core.util.TextBuffer.finishCurrentSegment(TextBuffer.java:939)
	at com.fasterxml.jackson.core.json.UTF8StreamJsonParser._finishString2(UTF8StreamJsonParser.java:2584)
	at com.fasterxml.jackson.core.json.UTF8StreamJsonParser._finishAndReturnString(UTF8StreamJsonParser.java:2560)
	at com.fasterxml.jackson.core.json.UTF8StreamJsonParser.getText(UTF8StreamJsonParser.java:335)
	at play.api.libs.json.jackson.JsValueDeserializer.deserialize(JacksonJson.scala:202)
	at play.api.libs.json.jackson.JsValueDeserializer.deserialize(JacksonJson.scala:157)
	at play.api.libs.json.jackson.JsValueDeserializer.deserialize(JacksonJson.scala:152)
	at com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue(DefaultDeserializationContext.java:323)
	at com.fasterxml.jackson.databind.ObjectMapper._readValue(ObjectMapper.java:4801)
	at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:2974)
	at play.api.libs.json.jackson.JacksonJson.parseJsValue(JacksonJson.scala:310)
	at play.api.libs.json.StaticBinding$.parseJsValue(StaticBinding.scala:21)
	at play.api.libs.json.Json$.parse(Json.scala:175)
	at org.apache.james.jmap.json.ResponseSerializer$.deserializeRequestObject(ResponseSerializer.scala:169)
	at org.apache.james.jmap.routes.JMAPApiRoutes.parseRequestObject(JMAPApiRoutes.scala:85)

Values larger than 20MB are rejected.

That's nice! But on user (attacker?) controlled input I would like to lower the value even more!

Actual Behavior

Today looking at JsonConfig object this do not seem possible.

[mkurz]

@chibenwa Pull request welcome!