The nesting limit defines how many JSON arrays or objects may be open at the same time. For\n * example a nesting limit of 0 means no arrays or objects may be opened at all, a nesting limit\n * of 1 means one array or object may be open at the same time, and so on. So a nesting limit of 3\n * allows reading the JSON data [{\"a\":[true]}], but for a nesting limit of 2 it would\n * fail at the inner {@code [true]}.\n *\n *
The nesting limit can help to protect against a {@link StackOverflowError} when recursive\n * {@link com.google.gson.TypeAdapter} implementations process deeply nested JSON data.\n *\n *
The default nesting limit is {@value #DEFAULT_NESTING_LIMIT}.\n *\n * @throws IllegalArgumentException if the nesting limit is negative.\n * @since 2.12.0\n * @see #getNestingLimit()\n */\n public final void setNestingLimit(int limit) {\n if (limit < 0) {\n throw new IllegalArgumentException(\"Invalid nesting limit: \" + limit);\n }\n this.nestingLimit = limit;\n }\n\n /**\n * Returns the nesting limit of this reader.\n *\n * @since 2.12.0\n * @see #setNestingLimit(int)\n */\n public final int getNestingLimit() {\n return nestingLimit;\n }\n\n /**\n * Consumes the next token from the JSON stream and asserts that it is the beginning of a new\n * array.\n *","sourceCodeStart":419,"sourceCodeEnd":455,"githubUrl":"https://github.com/google/gson/blob/310ac341f2f92a454b229bf21f70d2d18b2b6db7/gson/src/main/java/com/google/gson/stream/JsonReader.java#L419-L455","documentation":"Thrown by JsonReader.setNestingLimit(int) when limit < 0 (JsonReader.java:435-438). The nesting limit caps how many arrays/objects may be open at once and must be non-negative; a negative value has no meaningful interpretation and is rejected immediately. The default is 255.","triggerScenarios":"Calling reader.setNestingLimit(-1) or passing a computed value that underflows (e.g. derivedDepth - offset where offset exceeds depth). Also when a config property is misread as a negative integer.","commonSituations":"Reading nesting depth from external configuration with a typo or missing default; arithmetic that subtracts a safety margin and goes negative for shallow inputs; copying a value sourced from another reader without clamping.","solutions":["Pass a non-negative value; use 0 to forbid any nesting or a value >= expected depth.","Clamp the computed limit with Math.max(0, computed) before calling setNestingLimit.","If the limit comes from config, validate and fall back to the default 255 when invalid.","Add a guard at the configuration boundary so the reader never sees a negative number."],"exampleFix":"// before\nreader.setNestingLimit(requestedDepth - safetyMargin);\n\n// after\nreader.setNestingLimit(Math.max(0, requestedDepth - safetyMargin));","handlingStrategy":"validation","validationCode":"int limit = Math.max(0, configuredLimit);\nreader.setNestingLimit(limit);","typeGuard":"static boolean isValidNestingLimit(int limit) {\n return limit >= 0;\n}","tryCatchPattern":"try {\n reader.setNestingLimit(limit);\n} catch (IllegalArgumentException e) {\n reader.setNestingLimit(0);\n}","preventionTips":["Clamp computed limits to a minimum of 0.","Validate config values at load time rather than at parse time.","Default to the built-in 255 when config is missing or malformed."],"tags":["java","gson","jsonreader","config","validation"],"backgroundTag":null,"analyzedSha":"310ac341f2f92a454b229bf21f70d2d18b2b6db7","analyzedAt":"2026-08-10T02:58:47.455Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}