Repository navigation
producers: refuse a message nested past MaxNestingDepth (protowire#502) #34
Description
trendvidia/protowire#502 (decided by the owner): a producer of PXF text or of PB must fail with an error on a message nested more deeply than MaxNestingDepth (default 100, configurable per call), counted as a decoder reading the output would count it. HARDENING.md § Recursion, draft -01 § Recursion.
Not measured: at main b8d7b7f the stock upb reader in pb-render refuses both 101-level rows (Exceeded upb_DecodeOptions_MaxDepth, exit 2).
The corpus pins the PXF producer with pb-render rows: pb/deep-submessage-{100,101} and pb/deep-map-{100,101}. For those rows check-decode's stock protobuf reader must allow deeper input than 100. Otherwise it refuses the bytes before the producer runs, and the reject row passes without testing anything. The reject rows list this port in skip until then.
Done when: the PXF and PB producers refuse past the limit (with a per-call option to raise it), pb-render raises the stock reader's limit, and the port is removed from the two reject rows' skip.
Activity
bfrancojr commentedon Nov 6, 2026
PXF producer side: #41 merged (1ccd1c5). The spec change that drops
pythonfrom the twopb-renderrows'skipis trendvidia/protowire#587. With it,cross_security_check.shpasses for Python on 128 pairs, up from 124.Still open after #587 merges: whether the PB-producer half applies to this port. Python writes PB only through
google.protobuf'sSerializeToStringand has no PB encoder of its own. This issue stays open for that decision.bfrancojr commentedon Nov 8, 2026
This issue's open half (the PB producer) and #36's PB rows turn out to be the same question: whether Python gets its own PB codec, as Go's
encoding/pb. Options, Go comparison and a recommendation are in #36 (comment).bfrancojr commentedon Nov 8, 2026
Decided by the owner (2026-11-07): port Go's
encoding/pbto Python. Python gets its own PB codec, with Go'sUnmarshalOptionslimits and aMarshalthat refuses pastMaxNestingDepth. That closes this issue's PB half by implementation. An API proposal follows before the build.bfrancojr commentedon Nov 8, 2026
The PB-producer half:
pb.marshalandpb.Encoderrefuse a value nested pastmax_nesting_depth, counted aspb.unmarshalcounts it (Go'smarshal_depth_test.gois ported intests/test_pb_depth.py). In #53, which closes this issue.