timescale.info#394 · Limit exponents and sizes in parsed times
- timeline-app
- pull request
Times given as decimals were read with `Q.parseDecimal`, which has no exponent limit, so very large exponents made parsing slow: `1e3000000` took about 320 ms and built a 10-million-bit number, and a dozen characters such as `1e1000000000` asked for far more. This reached request bounds and thresholds (`bound()` in `server/http.mjs`), document validation, duration ends and time mappings. ## Changes - **`src/numeric.ts`:** a `parseDecimal` helper wraps `Q.parseDecimal` with the same ±10,000 exponent limit `parseNumber` already had (now one shared check, `EXPONENT_LIMIT`, with the same message: "Scientific exponents must be between -10000 and 10000."). - **`src/core.ts` `parseTime`:** uses the helper, and limits a time to 20,000 characters both as written and as its exact fraction ("Times must be at most 20000 characters, also as an exact fraction."). The length limit also covers long digit strings, long `a/b` fractions and ISO timestamps; checking the canonical fraction too means every stored time reads back (for example `1.111…e-10000` is short as written but expands past the limit). `1e±10000` (10,003 characters as a fraction) is well inside it, and a 20,000-character time parses in a few milliseconds. - **`src/time-map.ts`:** scale, offset and around use the helper (they were already capped at 4,000 characters, but not in exponent). - **Docs:** `docs/time-presentation.md` and the OpenAPI `Rational` and input-time schemas (`maxLength: 20000`) state the limits. - **Tests:** `parseTime` limits and messages, document validation, time mappings, and HTTP query bounds/thresholds answering 400. The vendored libraries are unchanged (they are maintained upstream). Other `Q.parseDecimal` callers in `src/` read numbers the app made itself. The desktop and native store have no decimal parser of their own in use: they store canonical `n/d` text that came through the JS core. sqlite-rational's `q_decimal` has no exponent limit either, but the app never calls it; that would be fixed upstream.
Sources
Open #394 · Limit exponents and sizes in parsed times in the timeline