play-json icon indicating copy to clipboard operation
play-json copied to clipboard

Json.parse fails for strings > 5000000 in length

Open RiteshBM opened this issue 1 year ago • 6 comments

Play JSON Version (2.5.x / etc)

2.9.4

API (Scala / Java / Neither / Both)

Scala

Operating System (Ubuntu 15.10 / MacOS 10.10 / Windows 10)

MacOS 14.3 M1

JDK (Oracle 1.8.0_72, OpenJDK 1.8.x, Azul Zing)

Amazon Cornetto Java 17.0.7

Library Dependencies

com.fasterxml.jackson.core:jackson-databind "2.15.0" com.fasterxml.jackson.core:jackson-core "2.15.0" com.fasterxml.jackson.core:jackson-annotations "2.15.0" com.fasterxml.jackson.module:jackson-module-scala_2.12 "2.15.0"

Expected Behavior

  1. Parsing a JSON String with length > 5000000
  2. Returns a JsValue Object

Actual Behavior

throws an exception: com.fasterxml.jackson.core.exc.StreamConstraintsException: String length (5043551) exceeds the maximum length (5000000)

Jackson version: 2.15.0

Reproducible Test Case

val largeString = "a" * 20 * 1000000 val largeJsonString = s"""{ "key": "$largeString" }"""

Related Issues

https://github.com/FasterXML/jackson-core/issues/1001

I've used Json.parse in multiple places. I think Play doesn't expose a way to configure this limit globally. Will I have to create a custom ObjectMapper everywhere ?

RiteshBM avatar Jun 26 '24 17:06 RiteshBM

Will take a look at this in the course of upgrading jackson.

mkurz avatar Jun 27 '24 11:06 mkurz

@RiteshBM Play does not support Jackson 2.15 or above. Jackson 2.15 introduced StreamReadConstraints and Play has not yet implemented anything to allow users with very large JSON docs to override the default Jackson settings.

Stick with Jackson 2.14.

pjfanning avatar Jul 09 '24 13:07 pjfanning

@pjfanning Does it mean I can't use Play without bypassing this limit if other packages require jackson > 2.14.

RiteshBM avatar Jul 18 '24 16:07 RiteshBM

@RiteshBM Play does not support Jackson 2.15 or above. Jackson 2.15 introduced StreamReadConstraints and Play has not yet implemented anything to allow users with very large JSON docs to override the default Jackson settings.

Stick with Jackson 2.14.

Try calling this method to override the StreamReadConstraints.

https://www.javadoc.io/static/com.fasterxml.jackson.core/jackson-core/2.18.4/com/fasterxml/jackson/core/StreamReadConstraints.html#overrideDefaultStreamReadConstraints-com.fasterxml.jackson.core.StreamReadConstraints-

pjfanning avatar Jul 18 '24 17:07 pjfanning

Any chance this could get fixed soon?

The AWS Java SDK has required Jackson 2.15 since 2023, and this is blocking me from upgrading that.

tmccombs avatar May 20 '25 16:05 tmccombs

@tmccombs I published my own copy of this jar - https://github.com/pjfanning/play-json/ which includes some changes to support newer versions of jackson.

If you son't want to use my fork, you could perhaps try the workaround in https://github.com/playframework/play-json/issues/1054#issuecomment-2237112907

pjfanning avatar May 20 '25 16:05 pjfanning

#1072 is merged now.

The default for string is 20M since jackson 2.15.1 anyway, and with #1072 you can now configure the limit.

mkurz avatar Jul 09 '25 22:07 mkurz

Version 3.0.6 depends on Jackson 2.20, but it doesn't seem to allow configuring the limit. Indeed looking at the code for JsonConfig on the 3.0.6 tag it doesn't seem to have any of the code from #1072 for allowing configuration of the StreamReadConstraints, although that code does appear to be on master.

Will this be part of 3.1.0?

tmccombs avatar Oct 16 '25 18:10 tmccombs

Version 3.0.6 depends on Jackson 2.20

No, it does not, take a look at the pom. And yes, next non-patch release will upgrade to latest Jackson 2.x.

Do you get an exceptoin with 3.0.6? Or experience a different behaviour than 3.0.5?

mkurz avatar Oct 16 '25 19:10 mkurz

3.1.0-M4 supports setting stream read constraint values. 3.0.6 dependency is on Jackson 2.14.3 from before these constraints were added.

You can check the dependencies using https://mvnrepository.com/artifact/org.playframework/play-json

pjfanning avatar Oct 17 '25 05:10 pjfanning