@@ -63,6 +63,7 @@ and implements the following features:
6363- [x] Key folding to collapse single-key object chains into dotted paths
6464- [x] Configurable flatten depth to limit the depth of key folding
6565- [x] Collision avoidance so folded keys never collide with existing sibling keys
66+ - [x] Configurable encoding limits for security
6667
6768### TOONDecoder
6869
@@ -315,6 +316,21 @@ database.connection:
315316 port: 5432
316317```
317318
319+ ### Encoding Limits
320+
321+ Protect against stack overflow from deeply nested structures:
322+
323+ ``` swift
324+ let encoder = TOONEncoder ()
325+ encoder.limits = TOONEncoder.EncodingLimits (maxDepth : 64 )
326+ ```
327+
328+ | Limit | Default | Description |
329+ | -------| ---------| -------------|
330+ | ` maxDepth ` | 32 | Maximum nesting depth |
331+
332+ Use ` .unlimited ` for trusted data only.
333+
318334### Decoding Limits
319335
320336Protect against malicious or malformed input:
@@ -329,6 +345,15 @@ decoder.limits = TOONDecoder.DecodingLimits(
329345)
330346```
331347
348+ | Limit | Default | Description |
349+ | -------| ---------| -------------|
350+ | ` maxInputSize ` | 10 MB | Maximum input size in bytes |
351+ | ` maxDepth ` | 32 | Maximum nesting depth |
352+ | ` maxObjectKeys ` | 10,000 | Maximum keys per object |
353+ | ` maxArrayLength ` | 100,000 | Maximum elements per array |
354+
355+ Use ` .unlimited ` for trusted data only.
356+
332357### Version Information
333358
334359Check the supported TOON specification version:
0 commit comments