Skip to content

fix: prevent stack overflow on deeply nested JSON payloads - #111

Merged
nfvelten merged 1 commit into
masterfrom
fix/payload-filter-stack-overflow
Apr 7, 2026
Merged

fix: prevent stack overflow on deeply nested JSON payloads#111
nfvelten merged 1 commit into
masterfrom
fix/payload-filter-stack-overflow

Conversation

@nfvelten

@nfvelten nfvelten commented Apr 7, 2026

Copy link
Copy Markdown
Contributor

Summary

  • scan_value in payload_filter.rs was fully recursive and would overflow the stack on pathologically nested JSON arguments. Replaced with an explicit-stack iterative traversal capped at MAX_DEPTH = 64.
  • redact_value in gateway.rs was also recursive; refactored to depth-parameterised recursion (redact_value_depth) that returns the value unchanged beyond REDACT_MAX_DEPTH = 64 instead of panicking.
  • Added two unit tests: one verifying deeply nested input (MAX_DEPTH+10) is blocked, one verifying input exactly at MAX_DEPTH is allowed through.

Closes #95

Test plan

  • cargo test --lib — all 431 unit tests pass
  • cargo clippy -- -D warnings — zero warnings
  • cargo fmt --check — no formatting violations
  • New test deeply_nested_json_blocked — nesting beyond MAX_DEPTH triggers block
  • New test max_depth_exactly_allowed — nesting at exactly MAX_DEPTH passes through

🤖 Generated with Claude Code

Replace recursive scan_value with an iterative explicit-stack traversal
capped at MAX_DEPTH=64. Refactor redact_value to depth-parameterised
recursion that returns the value unchanged beyond REDACT_MAX_DEPTH=64
instead of panicking. Add two boundary unit tests.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@nfvelten
nfvelten merged commit e6841ab into master Apr 7, 2026
3 checks passed
@nfvelten
nfvelten deleted the fix/payload-filter-stack-overflow branch April 7, 2026 18:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: recursive scan_value/redact_value in payload filter can stack overflow on deeply nested JSON

1 participant