{"record":{"id":"5551e757e034dc59","repo":"google/gson","slug":"number-string-too-large-s-substring-0-30","errorCode":null,"errorMessage":"Number string too large: ${s.substring(0, 30)}...","messagePattern":"Number string too large: (.+?)\\.\\.\\.","errorType":"exception","errorClass":"NumberFormatException","httpStatus":null,"severity":"error","filePath":"gson/src/main/java/com/google/gson/internal/NumberLimits.java","lineNumber":17,"sourceCode":"package com.google.gson.internal;\n\nimport java.math.BigDecimal;\nimport java.math.BigInteger;\n\n/**\n * This class enforces limits on numbers parsed from JSON to avoid potential performance problems\n * when extremely large numbers are used.\n */\npublic final class NumberLimits {\n  private NumberLimits() {}\n\n  private static final int MAX_NUMBER_STRING_LENGTH = 10_000;\n\n  private static void checkNumberStringLength(String s) {\n    if (s.length() > MAX_NUMBER_STRING_LENGTH) {\n      throw new NumberFormatException(\"Number string too large: \" + s.substring(0, 30) + \"...\");\n    }\n  }\n\n  public static BigDecimal parseBigDecimal(String s) throws NumberFormatException {\n    checkNumberStringLength(s);\n    BigDecimal decimal = new BigDecimal(s);\n\n    // Cast to long to avoid issues with abs when value is Integer.MIN_VALUE\n    if (Math.abs((long) decimal.scale()) >= 10_000) {\n      throw new NumberFormatException(\"Number has unsupported scale: \" + s);\n    }\n    return decimal;\n  }\n\n  public static BigInteger parseBigInteger(String s) throws NumberFormatException {\n    checkNumberStringLength(s);\n    return new BigInteger(s);\n  }","sourceCodeStart":1,"sourceCodeEnd":35,"githubUrl":"https://github.com/google/gson/blob/310ac341f2f92a454b229bf21f70d2d18b2b6db7/gson/src/main/java/com/google/gson/internal/NumberLimits.java#L1-L35","documentation":"NumberLimits enforces a 10,000-character cap on number strings parsed from JSON to prevent algorithmic-complexity attacks (BigDecimal/BigInteger parsing is superlinear). Strings exceeding MAX_NUMBER_STRING_LENGTH throw NumberFormatException with a 30-char preview (NumberLimits.java:16).","triggerScenarios":"Calling NumberLimits.parseBigDecimal or parseBigInteger (or Gson paths that funnel through them, e.g. LazilyParsedNumber.asBigDecimal / big-decimal coercion) on a JSON number with more than 10,000 characters.","commonSituations":"Processing untrusted JSON containing adversarial huge numbers; binary blobs encoded as numeric strings; misformatted scientific-notation fields with absurd exponents; accidental concatenation producing very long numeric strings.","solutions":["Validate input length before parsing and reject/truncate at the trust boundary.","If you genuinely need huge numbers, pre-process the JSON to express them as quoted strings and parse with an explicit, bounded parser.","Cap request body size upstream so such payloads never reach the parser."],"exampleFix":"// before\nBigDecimal v = NumberLimits.parseBigDecimal(hugeNumberString);\n// after\nif (hugeNumberString.length() > 10_000) throw new IllegalArgumentException(\"number too large\");\nBigDecimal v = NumberLimits.parseBigDecimal(hugeNumberString);","handlingStrategy":"validation","validationCode":"private static final int MAX = 10_000;\nif (s != null && s.length() > MAX) throw new NumberFormatException(\"number string too large\");\nBigDecimal d = NumberLimits.parseBigDecimal(s);","typeGuard":"static boolean withinLength(String s) { return s != null && s.length() <= 10_000; }","tryCatchPattern":"try { NumberLimits.parseBigDecimal(s); } catch (NumberFormatException e) { /* too large or malformed */ }","preventionTips":["Cap incoming JSON/request body size at the trust boundary.","Reject or coerce to String any numeric field whose source length can exceed 10k chars.","Treat NumberFormatException from numeric coercion as a malformed-input signal, not a crash."],"tags":["gson","parsing","dos","number","security"],"backgroundTag":null,"analyzedSha":"310ac341f2f92a454b229bf21f70d2d18b2b6db7","analyzedAt":"2026-08-10T02:58:47.455Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}