Skip to content

Fix BoundedReader array and CharBuffer reads bypassing limits - #919

Closed
ETF-7 wants to merge 2 commits into
apache:masterfrom
ETF-7:fix/bounded-reader-overloads
Closed

ETF-7 wants to merge 2 commits into
apache:masterfrom
ETF-7:fix/bounded-reader-overloads

Conversation

@ETF-7

@ETF-7 ETF-7 commented Oct 28, 2026

Copy link
Copy Markdown

BoundedReader inherits read(char[]) and read(CharBuffer) from ProxyReader. Both inherited methods delegate directly to the wrapped reader, bypassing BoundedReader's limit and character count. For example, IOUtils.copy(new BoundedReader(new StringReader("01234567890"), 3), writer) currently copies all 11 characters instead of 3.

Override both overloads so that they use the existing bounded read paths. Preserve the destination CharBuffer position and reject a read-only buffer before consuming input. Regression tests cover array reads, heap and direct CharBuffers, mixed read calls, EOF and empty destinations, read-only buffers, and IOUtils.copy.

Related to SLING-13268, where the downstream workaround replaced BoundedReader after it stopped enforcing the bound with IOUtils.copy. This PR addresses the upstream reader behavior.

Validation on Windows with Java 21 and Maven 3.9.6:

  • Before the implementation change, mvn -B -ntp -Dtest=BoundedReaderTest test ran 25 tests with 5 failures, demonstrating the regression.
  • With the fix, the same command passed all 25 tests.
  • mvn -B -ntp -DskipTests -DskipITs passed the default build and non-test checks, including RAT, binary compatibility, Checkstyle, SpotBugs, PMD, and Javadoc.
  • The full default mvn -B -ntp run completed with 7,315 tests, 3 failures, 60 errors, and 51 skipped. The failures/errors were caused by missing Windows symbolic-link privileges and one HTTPS handshake failure in URIOriginTest. BoundedReaderTest passed in this run. The full default build is therefore left unchecked below.
  • The published branch was fetched and compared against the tested local files; both files match exactly.

AI disclosure: OpenAI Codex generated the implementation, regression tests, commit descriptions, and this PR description, and performed repository inspection and validation. Both commits include Assisted-By: OpenAI Codex.

  • Read the contribution guidelines.
  • Read the ASF Generative Tooling Guidance.
  • I used AI to create part or all of this pull request; tool and extent are disclosed above.
  • Run a successful build using the default Maven goal with mvn (environment limitations described above).
  • Write unit tests that match behavioral changes and fail without the implementation changes.
  • Write a description explaining what, how, and why.
  • Use meaningful commit subjects and bodies.

ETF-7 added 2 commits October 28, 2026 15:55
Route array and CharBuffer reads through the existing bounded read paths.

Related to SLING-13268.

Assisted-By: OpenAI Codex
Cover array reads, heap and direct CharBuffer reads, count updates, read-only buffers, and IOUtils.copy respecting the configured bound.

Assisted-By: OpenAI Codex
@ETF-7 ETF-7 closed this Oct 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant