The ApiFirewall Is Not Applying The MaxChildElementDepth Limit Properly (Doc ID 2559603.1)

Last updated on DECEMBER 22, 2020

Applies to:

Symptoms

The ApiFirewall is counting the number of characters "{" regardless of the closing of the objects for the limit given by MaxChildElementDepth. This means that a JSON containing a long list of low depth objects is being rejected.
Test shows in a JSON the number of opened braces is 2107 . With the MaxChildElementDepth to 2015 the message gets rejected. When changing it to 2016 (total of open braces minus one for the root) it goes through.

The MaxChildElementDepth should specify the maximum number of nested elements allowed in a message with the following format:

<val1>
     <child1>
         <child2>
             <child3>
                 value
             </child3>
         </child2>
     </child1>
</val1>

While for a maximum depth of 3, the JSON is rejected having a MaxChildElementDept of 1024.

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.