Enforce parser resource budgets in core code before format callbacks retain data.
Scope
Account for XML events, nesting depth, attributes, attribute bytes, feed metadata bytes, current-item bytes, and parse timeout boundaries. Establish stable resource-limit errors and shared accounting used by every format.
Acceptance Criteria
Limits are checked incrementally before state is appended.
Format implementations cannot bypass shared limits.
Depth, event, attribute, metadata, and item budgets are configurable.
Oversized and pathological XML inputs fail deterministically.
Shared contract tests cover all built-in formats.
## Objective
Enforce parser resource budgets in core code before format callbacks retain data.
## Scope
Account for XML events, nesting depth, attributes, attribute bytes, feed metadata bytes, current-item bytes, and parse timeout boundaries. Establish stable resource-limit errors and shared accounting used by every format.
## Acceptance Criteria
- Limits are checked incrementally before state is appended.
- Format implementations cannot bypass shared limits.
- Depth, event, attribute, metadata, and item budgets are configurable.
- Oversized and pathological XML inputs fail deterministically.
- Shared contract tests cover all built-in formats.
mmacia
self-assigned this 2026-10-16 10:12:24 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Objective
Enforce parser resource budgets in core code before format callbacks retain data.
Scope
Account for XML events, nesting depth, attributes, attribute bytes, feed metadata bytes, current-item bytes, and parse timeout boundaries. Establish stable resource-limit errors and shared accounting used by every format.
Acceptance Criteria