Enforce max input length to the Ada URL parser (ada-url#1126)

* This commit introduces max input length controls to the Ada URL parser library, adding ada::set_max_input_length() and ada::get_max_input_length() functions for configurable limits (defaulting to 4GB) to prevent DoS attacks and excessive memory usage. Key changes include a new get_href_size() method for efficient size calculation without allocation, enforcement checks in all parsers and setters with automatic reversion on limit exceedance, and comprehensive tests including unit tests in max_input_length.cpp and a fuzzing simulation in max_length_fuzzer.cpp. The implementation uses thread-safe atomics, preserves ABI compatibility by only adding new functions, and covers edge cases like percent-encoding expansion and cumulative setter operations.

* lint

* various fixes

* lint

* saving a load

* tuning

* lint/clean

Author: lemire

README.md

@@ -179,6 +179,47 @@ url->set_hash("is-this-the-real-life"); // Update hash/fragment
 // url->get_hash() will return "#is-this-the-real-life"
 ```
 
+### URL Size Limit
+
+By default, ada allows URLs up to about 4 GB. You can set a lower limit to
+reject any URL whose serialized form (the href) would exceed a given number
+of bytes. The limit is enforced during parsing and across all setters.
+Setters that return `bool` return `false` when the limit would be exceeded;
+`void` setters (`set_search`, `set_hash`) silently leave the URL unchanged.
+In all cases the URL is never modified when a limit violation is detected.
+Percent-encoding expansion is accounted for: a short input that encodes into
+a long result is still rejected.
+
+```cpp
+// Set a 2 KB limit (any uint32_t value works).
+ada::set_max_input_length(2048);
+
+// Parsing a URL whose normalized form exceeds 2 KB fails.
+auto url = ada::parse("http://example.com/" + std::string(2048, 'a'));
+assert(!url);  // too long
+
+// Setters that would push the URL over the limit are rejected.
+auto u = ada::parse<ada::url_aggregator>("http://example.com/");
+assert(u);
+bool ok = u->set_pathname(std::string(2048, 'x'));
+assert(!ok);  // pathname too long; URL unchanged
+
+// Read the current limit.
+uint32_t limit = ada::get_max_input_length();
+
+// Reset to the default (no practical limit).
+ada::set_max_input_length(UINT32_MAX);
+```
+
+You can query the byte length of a URL without allocating a string via `get_href_size()`:
+
+```c++
+auto url = ada::parse<ada::url_aggregator>("https://example.com/path");
+assert(url);
+size_t len = url->get_href_size();  // no allocation
+assert(len == url->get_href().size());
+```
+
 ### URL Search Params
 
 ```cpp

benchmarks/bench_ipv4.cpp

@@ -139,7 +139,7 @@ void run_benchmark(benchmark::State& state,
     for (size_t i = 0; i < count; ++i) {
       auto result = ada::parse<ResultType>(urls[order[pos]]);
       if (result) {
-        success++;
+        success = success + 1;
       }
       benchmark::DoNotOptimize(result);
 
@@ -161,7 +161,7 @@ void run_benchmark(benchmark::State& state,
       for (size_t j = 0; j < count; ++j) {
         auto result = ada::parse<ResultType>(urls[order[pos]]);
         if (result) {
-          success++;
+          success = success + 1;
         }
         benchmark::DoNotOptimize(result);
         pos += stride;

fuzz/max_length.cc

@@ -0,0 +1,157 @@
+#include <fuzzer/FuzzedDataProvider.h>
+
+#include <cassert>
+#include <cstdio>
+#include <limits>
+#include <string>
+#include <type_traits>
+
+#include "ada.cpp"
+#include "ada.h"
+
+// Enforce a tight limit and verify that no operation can produce
+// a URL whose serialized form exceeds it.
+static constexpr uint32_t kMaxLength = 512;
+
+template <class T>
+static void check_length(const T& url, const char* context) {
+  if (url.get_href_size() > kMaxLength) {
+    printf("FAIL [%s]: href_size=%zu exceeds limit %u\n  href: ", context,
+           url.get_href_size(), kMaxLength);
+    if constexpr (std::is_same_v<T, ada::url_aggregator>) {
+      printf("%.*s\n", (int)url.get_href().size(), url.get_href().data());
+    } else {
+      printf("%s\n", url.get_href().c_str());
+    }
+    abort();
+  }
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  ada::set_max_input_length(kMaxLength);
+
+  FuzzedDataProvider fdp(data, size);
+
+  // Consume strings for initial parse and setter values.
+  std::string source = fdp.ConsumeRandomLengthString(1024);
+  std::string base_str = fdp.ConsumeRandomLengthString(256);
+
+  // --- Test 1: parse must not produce an href > kMaxLength ---
+  auto url = ada::parse<ada::url>(source);
+  auto agg = ada::parse<ada::url_aggregator>(source);
+
+  if (url) {
+    check_length(*url, "parse<url>");
+  }
+  if (agg) {
+    check_length(*agg, "parse<url_aggregator>");
+  }
+
+  // --- Test 2: parse with base ---
+  auto base_url = ada::parse<ada::url>(base_str);
+  auto base_agg = ada::parse<ada::url_aggregator>(base_str);
+
+  if (base_url) {
+    auto result = ada::parse<ada::url>(source, &*base_url);
+    if (result) {
+      check_length(*result, "parse<url>(source, base)");
+    }
+  }
+  if (base_agg) {
+    auto result = ada::parse<ada::url_aggregator>(source, &*base_agg);
+    if (result) {
+      check_length(*result, "parse<url_aggregator>(source, base)");
+    }
+  }
+
+  // --- Test 3: setters on a known-good URL ---
+  // Start from a short URL to maximise room for setter expansion.
+  auto setter_url = ada::parse<ada::url>("http://x/");
+  auto setter_agg = ada::parse<ada::url_aggregator>("http://x/");
+  if (!setter_url || !setter_agg) return 0;
+
+  // Apply a fuzz-driven sequence of setter calls.
+  int steps = fdp.ConsumeIntegralInRange(1, 16);
+  for (int i = 0; i < steps && fdp.remaining_bytes() > 0; ++i) {
+    std::string val = fdp.ConsumeRandomLengthString(512);
+    int which = fdp.ConsumeIntegralInRange(0, 9);
+    switch (which) {
+      case 0:
+        setter_url->set_protocol(val);
+        setter_agg->set_protocol(val);
+        break;
+      case 1:
+        setter_url->set_username(val);
+        setter_agg->set_username(val);
+        break;
+      case 2:
+        setter_url->set_password(val);
+        setter_agg->set_password(val);
+        break;
+      case 3:
+        setter_url->set_hostname(val);
+        setter_agg->set_hostname(val);
+        break;
+      case 4:
+        setter_url->set_host(val);
+        setter_agg->set_host(val);
+        break;
+      case 5:
+        setter_url->set_pathname(val);
+        setter_agg->set_pathname(val);
+        break;
+      case 6:
+        setter_url->set_search(val);
+        setter_agg->set_search(val);
+        break;
+      case 7:
+        setter_url->set_hash(val);
+        setter_agg->set_hash(val);
+        break;
+      case 8:
+        setter_url->set_port(val);
+        setter_agg->set_port(val);
+        break;
+      case 9:
+        setter_url->set_href(val);
+        setter_agg->set_href(val);
+        break;
+    }
+    check_length(*setter_url, "setter url");
+    check_length(*setter_agg, "setter url_aggregator");
+  }
+
+  // --- Test 4: aggressive percent-encoding expansion ---
+  // Characters like spaces, control chars, and braces expand 3x when
+  // percent-encoded. Try to overflow the limit via these characters.
+  {
+    auto pe_url = ada::parse<ada::url>("http://x/");
+    auto pe_agg = ada::parse<ada::url_aggregator>("http://x/");
+    if (pe_url && pe_agg) {
+      std::string expanding = fdp.ConsumeRandomLengthString(512);
+      pe_url->set_pathname(expanding);
+      pe_agg->set_pathname(expanding);
+      check_length(*pe_url, "percent-encode pathname url");
+      check_length(*pe_agg, "percent-encode pathname url_aggregator");
+
+      pe_url->set_username(expanding);
+      pe_agg->set_username(expanding);
+      check_length(*pe_url, "percent-encode username url");
+      check_length(*pe_agg, "percent-encode username url_aggregator");
+
+      pe_url->set_search(expanding);
+      pe_agg->set_search(expanding);
+      check_length(*pe_url, "percent-encode search url");
+      check_length(*pe_agg, "percent-encode search url_aggregator");
+
+      pe_url->set_hash(expanding);
+      pe_agg->set_hash(expanding);
+      check_length(*pe_url, "percent-encode hash url");
+      check_length(*pe_agg, "percent-encode hash url_aggregator");
+    }
+  }
+
+  // Reset to default so other tests/fuzzers are not affected.
+  ada::set_max_input_length(std::numeric_limits<uint32_t>::max());
+  return 0;
+}

include/ada/implementation.h

@@ -65,6 +65,11 @@ using result = tl::expected<result_type, ada::errors>;
  *
  * @note The parser is fully compliant with the WHATWG URL Standard.
  *
+ * Parsing fails if the input or the resulting normalized URL exceeds
+ * `get_max_input_length()` bytes (default ~4 GB, configurable via
+ * `set_max_input_length()`). This accounts for percent-encoding expansion:
+ * a short input that normalizes into a long URL is still rejected.
+ *
  * @example
  * ```cpp
  * // Parse an absolute URL
@@ -104,6 +109,11 @@ extern template ada::result<url_aggregator> parse<url_aggregator>(
  * object. Use this when you only need to validate URLs without needing
  * their parsed components.
  *
+ * When `get_max_input_length()` is set to a value smaller than the default,
+ * `can_parse` may still return `true` for overlength inputs that are
+ * structurally valid, because the fast path skips the length check for
+ * performance. Use `parse()` when strict length enforcement is required.
+ *
  * @param input The URL string to validate. Must be valid ASCII or UTF-8.
  * @param base_input Optional pointer to a base URL string for resolving
  *        relative URLs. If nullptr (default), the input is validated as
@@ -166,6 +176,26 @@ parse_url_pattern(std::variant<std::string_view, url_pattern_init>&& input,
  * @return A file:// URL string representing the given path.
  */
 std::string href_from_file(std::string_view path);
+
+/**
+ * Sets the maximum allowed length for URLs.
+ *
+ * Both the raw input and the resulting normalized URL (the href) are checked
+ * against this limit. Parsing or setter calls that would produce a URL
+ * exceeding this length are rejected. The value must fit in a uint32_t.
+ * The default is std::numeric_limits<uint32_t>::max() (approximately 4 GB).
+ *
+ * @param length The new maximum URL length in bytes.
+ */
+void set_max_input_length(uint32_t length);
+
+/**
+ * Returns the current maximum allowed length for URLs.
+ *
+ * @return The current maximum URL length in bytes.
+ */
+uint32_t get_max_input_length();
+
 }  // namespace ada
 
 #endif  // ADA_IMPLEMENTATION_H

include/ada/url-inl.h

@@ -23,8 +23,7 @@ namespace ada {
   return port.has_value();
 }
 [[nodiscard]] inline bool url::cannot_have_credentials_or_port() const {
-  return !host.has_value() || host.value().empty() ||
-         type == ada::scheme::type::FILE;
+  return !host.has_value() || host->empty() || type == ada::scheme::type::FILE;
 }
 [[nodiscard]] inline bool url::has_empty_hostname() const noexcept {
   if (!host.has_value()) {
@@ -217,6 +216,48 @@ constexpr void url::copy_scheme(const ada::url& u) {
   return output;
 }
 
+[[nodiscard]] inline size_t url::get_href_size() const noexcept {
+  // Mirrors the logic of get_href() but only computes the total size.
+  size_t size = 0;
+  // Protocol: scheme + ":"
+  if (is_special()) {
+    size += ada::scheme::details::is_special_list[type].size() + 1;
+  } else {
+    size += non_special_scheme.size() + 1;
+  }
+  if (host.has_value()) {
+    size += host->size();
+    size += 2;  // "//"
+    if (has_credentials()) {
+      size += username.size();
+      if (!password.empty()) {
+        size += 1 + password.size();  // ":" + password
+      }
+      size += 1;  // "@"
+    }
+    if (port.has_value()) {
+      size += 1;  // ":"
+      // Count digits of port value without calling std::to_string.
+      uint16_t p = port.value();
+      size += (p >= 10000)  ? 5
+              : (p >= 1000) ? 4
+              : (p >= 100)  ? 3
+              : (p >= 10)   ? 2
+                            : 1;
+    }
+  } else if (!has_opaque_path && path.starts_with("//")) {
+    size += 2;  // "/."
+  }
+  size += path.size();
+  if (query.has_value()) {
+    size += 1 + query->size();  // "?" + query
+  }
+  if (hash.has_value()) {
+    size += 1 + hash->size();  // "#" + hash
+  }
+  return size;
+}
+
 ada_really_inline size_t url::parse_port(std::string_view view,
                                          bool check_trailing_content) noexcept {
   ada_log("parse_port('", view, "') ", view.size());

include/ada/url.h

@@ -162,6 +162,12 @@ struct url : url_base {
    */
   [[nodiscard]] ada_really_inline std::string get_href() const;
 
+  /**
+   * Returns the byte length of the serialized URL without allocating a string.
+   * @return Size of the href in bytes.
+   */
+  [[nodiscard]] size_t get_href_size() const noexcept;
+
   /**
    * Returns the URL's origin as a string (scheme + host + port for special
    * URLs).

include/ada/url_aggregator-inl.h

@@ -852,6 +852,10 @@ constexpr bool url_aggregator::has_port() const noexcept {
   return buffer;
 }
 
+[[nodiscard]] constexpr size_t url_aggregator::get_href_size() const noexcept {
+  return buffer.size();
+}
+
 ada_really_inline size_t
 url_aggregator::parse_port(std::string_view view, bool check_trailing_content) {
   ada_log("url_aggregator::parse_port('", view, "') ", view.size());

include/ada/url_aggregator.h

@@ -104,6 +104,12 @@ struct url_aggregator : url_base {
   [[nodiscard]] constexpr std::string_view get_href() const noexcept
       ada_lifetime_bound;
 
+  /**
+   * Returns the byte length of the serialized URL without allocating a string.
+   * @return Size of the href in bytes.
+   */
+  [[nodiscard]] constexpr size_t get_href_size() const noexcept;
+
   /**
    * Returns the URL's username component.
    * Does not allocate memory. The returned view becomes invalid if this

include/ada_c.h

@@ -184,6 +184,10 @@ ada_string_pair ada_search_params_entries_iter_next(
 bool ada_search_params_entries_iter_has_next(
     ada_url_search_params_entries_iter result);
 
+// max URL length configuration
+void ada_set_max_input_length(uint32_t length);
+uint32_t ada_get_max_input_length(void);
+
 // Definitions for Ada's version number.
 typedef struct {
   int major;

src/ada_c.cpp

@@ -743,6 +743,14 @@ bool ada_search_params_entries_iter_has_next(
   return (*r)->has_next();
 }
 
+void ada_set_max_input_length(uint32_t length) noexcept {
+  ada::set_max_input_length(length);
+}
+
+uint32_t ada_get_max_input_length() noexcept {
+  return ada::get_max_input_length();
+}
+
 typedef struct {
   int major;
   int minor;