THRIFT-6054: Limit recursion depth in Kotlin struct, union and exception read/write

[Jens-G]

THRIFT-6054: Limit recursion depth in Kotlin struct, union and exception read/write

Problem

Kotlin-generated struct and exception serialization routes through the shared Java runtime's TProtocol.readStruct() / writeStruct() callback helpers, which did not bound recursion depth. Kotlin-generated unions extend the shared org.apache.thrift.TUnion, whose read/write path calls readStructBegin() / writeStructBegin() directly and was likewise unbounded. A deeply nested or cyclic value could therefore be read or written without a limit.

Change

• Wrap the readStruct() / writeStruct() callback bodies (consumed by Kotlin-generated structs and exceptions) in incrementRecursionDepth() / try … finally / decrementRecursionDepth().
• Wrap TUnion's standard- and tuple-scheme read/write bodies the same way, closing the union path.

Both reuse the existing TProtocol infrastructure: limit from TConfiguration.getRecursionLimit() (default 64), TProtocolException.DEPTH_LIMIT on excess. The Java generator emits an inline StandardScheme that already increments separately and does not call the readStruct()/writeStruct() helpers, so Java struct serialization is unaffected (no double-counting). A union's standard and tuple schemes are mutually exclusive per protocol, so a union increments exactly once per level.

Notes for committer review

• The TUnion change lives in the shared lib/java runtime, so it also bounds Java-generated union recursion (not only Kotlin). Consequently Java union writes become bounded, whereas Java struct writes remain unbounded (the Java generator guards reads only). This asymmetry is intentional here but flagged for review.
• The TUnion tuple-scheme guard is not exercised by the test (which drives TBinaryProtocol, i.e. the standard scheme); it mirrors the verified standard-scheme pattern exactly.

Test

Replaces the isolated counter test with a generated-code round-trip (lib/kotlin RecursionDepthTest). Recursive types CoRec/CoRec2/RecTree/RecUnion/RecError are generated from src/test/resources/RecursionDepthTest.thrift (mirroring test/Recursive.thrift) and driven through TBase.read()/write():

• chains at the limit round-trip; chains one past it (write and read) are rejected with DEPTH_LIMIT — for structs, unions and exceptions;
• a wide structure confirms the counter is decremented per sibling;
• a cyclic graph is rejected instead of recursing without bound.

12/12 cases pass with the fix; reverting only TUnion.java makes exactly the two union over-limit cases fail while struct and exception cases still pass — confirming the union gap is real, the fix is load-bearing, and exceptions ride the existing TProtocol guard.

🤖 Generated with Claude Code