Backport PR #15720 to 8.12: Add system properties to configure Jackson's stream read constraints

[github-actions]

Backport PR #15720 to 8.12 branch, original message:

---

Release notes

Added jvm.options properties to configure the Jackson read constraints defaults (Maximum Number value length, Maximum String value length, and Maximum Nesting depth).

What does this PR do?

This PR adds 3 new custom system properties into the jvm.options. Those new properties are used to fine-tune the default Jackson stream read constraints values, which are used by Jackson to guard against malicious input by preventing processing of too big inputs. The added properties can be found here.

The intention of early set the Jackson defaults during the startup (runner.rb) was to ensure that all Logstash's functionalities that rely on Jackson are using those settings values.

Why is it important/What is the impact to the user?

Although the Jackson's defaults works for the majority of users, it might be too restrictive - and a blocker - for pipelines receiving big payload requests or with a deeper level of nested objects.

Having the possibility of tuning those properties is essential to unblock users with that use-case and for a more accurate guard against malicious inputs.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files (and/or docker env variables)
• I have added tests that prove my fix is effective or that my feature works

How to test this PR locally

• Set any property value to a lower/higher value, e.g.: -Dlogstash.jackson.stream-read-constraints.max-string-length=2
• Configure and run a pipeline with a beats input
• Send any data to this pipeline that exceeds the configured property value
• Check the logs for: com.fasterxml.jackson.core.exc.StreamConstraintsException: String length (24) exceeds the maximum length (2)

Related issues

• Closes https://github.com/elastic/ingest-dev/issues/2638

[elastic-sonarqube]

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: acc0731

Failed CI Steps

• 🥼 Integration Tests / part 1
• 🥼 Integration Tests / part 2
• 🥼 IT Persistent Queues / part 1
• 🥼 IT Persistent Queues / part 2

History

[jsvd]

LGTM