Jens-G opened a new pull request, #3881: URL: https://github.com/apache/thrift/pull/3881
`doc/specs/thrift-tconfiguration.md` has named three settings since 2019. Seven bindings have since grown a way to bound the declared element count of a list, set or map, and three have not — and where the setting exists it is spelled five different ways, with two different ideas of what its default should be. | Binding | Container-count limit | Where | Default | |---|---|---|---| | C glib | yes | `container_limit` property, binary + compact and their factories | `0` = off | | C++ | yes | `setContainerSizeLimit()` | `0` = off | | Java | yes | `containerLengthLimit_` ctor argument | `-1` = off | | D | yes | `containerSizeLimit` ctor argument | `16384000` | | Node.js | yes (compact) | `container_limit_` | `0` = off | | Rust | yes | `TConfiguration::max_container_size` | `None` = off | | Go | yes | `TConfiguration.MaxContainerSize` (THRIFT-6286) | `<= 0` = off | | netstd | no | — | — | | Haxe | no | — | — | | Delphi | no | — | — | THRIFT-5021 was raised because limits were, in this document's own words, "not consistently managed and just randomly distributed across the code base". Writing the setting down here is what keeps adding it to further bindings from recreating that condition. ## What this changes Specification only — no code, so there is nothing to test. * A fourth `## MaxContainerSize` section: what it bounds, and why `MaxMessageSize` cannot bound it on its own. `MaxMessageSize` is counted in bytes, while a container costs its element count times the in-memory footprint of one element. A list of structs whose smallest possible encoding is a single byte stays inside any byte budget while still asking for one object per declared element. * **The default is no limit of its own**, because a finite default would reject messages the same binding accepted before. * **The off value is anything less than or equal to zero**, with an option type permitted where the language has one. That rule is satisfied by every binding in the table above as it stands today — `0`, `-1` and `None` all qualify — so nothing existing has to change. * A `Further considerations` note that the older per-protocol knobs in C++, Java, D, C glib and Node.js already meet the same intent and should not be duplicated into `TConfiguration`, and that D's finite default predates this document. * A Q&A entry on why there is no `MaxStringSize`: a string's declared length *is* its length in bytes, so `MaxMessageSize` already bounds it directly. ## Scope The per-binding work is tracked as sub-tasks of THRIFT-6291 — THRIFT-6292 (netstd), THRIFT-6293 (Haxe), THRIFT-6294 (Delphi) — one pull request each. This PR is the specification alone. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
