3 ms·
It feels like a check against an input size of 10MB is something you would do well before deserialization, no?
by seangrogg 3y ago
It feels like a check against an input size of 10MB is something you would do well before deserialization, no?
- baq 3y agoYou would, but others might not. Defense in depth.
- afiori 3y agonot if it is a message you receive from a third party. A concrete example might be a batching third party client: the app sends N messages in a single batch and each message has its own size limit.
- tom_ 3y agoThe limit might apply to some specific part of the message, rather than the whole. You can't check this without actually deserialising, or at least doing most of the same work.