$ the-wire · showcase
buffa closes a JSON recursion bypass, shrinks generated encoders
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
2 people shipped this
The day's real work is in buffa: a raw_value-driven deserialization bypass that let a 2.1 MB body overflow a 38-level stack of nesting, plus a codegen change that cuts compiled binary size on multi-sink encoders.
json: read every object key as data when buffering a value anthropics/buffa
When any crate in a build enables serde_json's raw_value feature, serde_json::Value's Deserialize impl treats an object whose first key is $serde_json::private::RawValue as the JSON text under that key, parsed with a fresh recursion limit. buffa buffered untrusted JSON through that impl, so a sender could nest such strings past the 128-level limit and supply a value differing from the request t...
json: read every object key as data when buffering a value (#483) anthropics/buffa
iainmcgin's change makes buffa read every object key as data when buffering a value, closing the RawValue path at the source rather than only bounding recursion. Treat the two entries as one fix landing on main.
encode: write every BufMut through one pre-sized cursor anthropics/buffa
A generated write_to is instantiated once per sink type, so encoding into Vec<u8>, BytesMut, and a Rope carried three copies of every message's write code; buffa now writes every BufMut through one concrete cursor, sharing a single instance per message. On the whatsapp waproto schema (334 messages, 3,477 fields; fat LTO, text + data), a program encoding into three sinks shrinks 6.2% at opt-leve...
fix(reflect): return None for string lookups on non-string maps (#470) anthropics/buffa
Yong-yuan-X removed the debug assertion that made MapValue::get_str panic in debug builds on non-string-keyed maps, keeping the allocation-free binary search. Integer- and boolean-keyed maps now return None as documented, including through ReflectMap, with regression coverage for all non-string key variants.
fix(reflect): return None for string lookups on non-string maps anthropics/buffa
The same reflect fix tracked as its own pull request, carrying the changelog fragment and the before/after regression test.
Action items
- → Upgrade buffa to a build containing the raw_value JSON buffering fix if you deserialize untrusted JSON anthropics/buffa [immediate]
