{

if (max_ast_depth > std::numeric_limits<size_t>::max() / JSON_NESTING_BUDGET_PER_AST_LEVEL)

return std::numeric_limits<size_t>::max();

return max_ast_depth * JSON_NESTING_BUDGET_PER_AST_LEVEL;

{

size_t depth = 0;

size_t max_depth = 0;

bool in_string = false;

bool escaped = false;

for (char c : json)

{

if (in_string)

{

if (escaped)

escaped = false;

else if (c == '\\')

escaped = true;

else if (c == '"')

in_string = false;

continue;

}

if (c == '"')

in_string = true;

else if (c == '{' || c == '[')

{

++depth;

max_depth = std::max(max_depth, depth);

}

else if ((c == '}' || c == ']') && depth > 0)

--depth;

}

return max_depth;

{

/// `Poco::JSON::Parser::setDepth` does not actually bound recursion in our Poco fork

/// (`ParserImpl` stores `_depth` but `handle`/`handleObject`/`handleArray` never read it),

/// so a hostile deeply-nested payload would recurse through the parser and overflow the

/// stack before any AST-level depth check runs. Enforce a raw-text bracket budget first.

/// The budget is a safe multiple of the effective depth limit (the JSON encoding adds bracket

/// levels per AST/`Field` level), not the limit itself, so a valid serialized AST is never

/// rejected here — the constructed AST depth is still bounded by the counter check below.

/// The effective limit falls back to the stack-safety ceiling when `max_ast_depth = 0`, so the

/// guard cannot be turned off by a setting.

const size_t json_nesting_budget = jsonNestingBudget(effectiveJSONDeserializationMaxDepth());

if (computeJSONNestingDepth(json) > json_nesting_budget)

throw Exception(ErrorCodes::TOO_DEEP_AST,

"JSON nesting depth exceeds the limit derived from max_ast_depth ({}) during JSON AST deserialization", json_nesting_budget);

Poco::JSON::Parser parser;

/// Also request the parser-level bound (kept for forward compatibility if the fork starts

/// honouring it); the pre-scan above is the actual enforcement.

parser.setDepth(json_nesting_budget);

Poco::Dynamic::Var result;

try

{

result = parser.parse(json);

}

catch (const Poco::Exception & e)

{

throw Exception(ErrorCodes::BAD_ARGUMENTS, "Failed to parse JSON for AST deserialization: {}", e.displayText());

}

Poco::JSON::Object::Ptr obj;

try

{

obj = result.extract<Poco::JSON::Object::Ptr>();

}

catch (const Poco::Exception &)

{

throw Exception(ErrorCodes::BAD_ARGUMENTS, "Expected a JSON object for AST deserialization, got a different type");

}

if (!obj)

throw Exception(ErrorCodes::BAD_ARGUMENTS, "Expected a JSON object for AST deserialization");

return createFromJSON(*obj);

{

/// Check depth limit during recursive construction. When `max_ast_depth = 0` the semantic limit

/// is disabled, but the stack-safety ceiling still applies.

if (const size_t max_depth = effectiveJSONDeserializationMaxDepth(); json_deser_current_depth >= max_depth)

throw Exception(ErrorCodes::TOO_DEEP_AST,

"JSON AST deserialization exceeded maximum depth limit ({})", max_depth);

/// Check element count limit.

if (json_deser_max_elements && json_deser_current_elements >= json_deser_max_elements)

throw Exception(ErrorCodes::TOO_BIG_AST,

"JSON AST deserialization exceeded maximum element count limit ({})", json_deser_max_elements);

++json_deser_current_depth;

++json_deser_current_elements;

/// Decrement the depth counter on every exit path (including exceptions),

/// so a failed `readJSON` does not leak depth state for subsequent calls.

SCOPE_EXIT({ --json_deser_current_depth; });

if (!json.has("type"))

throw Exception(ErrorCodes::BAD_ARGUMENTS, "JSON object missing 'type' field for AST deserialization");

String type = json.getValue<String>("type");

const auto & factory = getASTFactory();

auto it = factory.find(type);

if (it == factory.end())

throw Exception(ErrorCodes::BAD_ARGUMENTS, "Unknown AST node type in JSON: '{}'", type);

/// Create empty instance.

ASTPtr node = it->second();

/// Populate from JSON via virtual dispatch.

/// readJSON may recursively call createFromJSON for child nodes.

node->readJSON(json);

return node;

{

/// Set thread-local limits for recursive deserialization.

json_deser_max_depth = max_depth;

json_deser_max_elements = max_elements;

json_deser_current_depth = 0;

json_deser_current_elements = 0;

try

{

auto result = createFromJSON(json);

/// Reset limits after successful deserialization.

json_deser_max_depth = 0;

json_deser_max_elements = 0;

return result;

}

catch (...)

{

/// Reset limits on failure too.

json_deser_max_depth = 0;

json_deser_max_elements = 0;

throw;

}

{

if (json_deser_max_elements && json_deser_current_elements >= json_deser_max_elements)

throw Exception(ErrorCodes::TOO_BIG_AST,

"JSON AST deserialization exceeded maximum element count limit ({})", json_deser_max_elements);

++json_deser_current_elements;

{

if (!json_deser_max_elements)

return std::numeric_limits<size_t>::max();

if (json_deser_current_elements >= json_deser_max_elements)

return 0;

return json_deser_max_elements - json_deser_current_elements;

{

/// In the `clickhouse_json` dialect, a leading `SET` query is an escape hatch back to a

/// SQL dialect. Detect it via the lexer so that leading SQL comments and whitespace are

/// skipped exactly as normal parsing would (e.g. `-- switch back\nSET dialect = 'clickhouse'`

/// or `/* */ SET ...`), rather than only stripping ASCII whitespace.

/// `max_query_size` bounds the lexer so that an oversized leading comment cannot make it scan

/// far past the per-query limit before the caller's own `max_query_size` guard runs.

Lexer lexer(begin, end, max_query_size);

Token token = lexer.nextToken();

while (!token.isEnd() && !token.isError() && !token.isSignificant())

token = lexer.nextToken();

if (token.type != TokenType::BareWord)

return false;

std::string_view text(token.begin, token.size());

if (text.size() != 3)

return false;

return (text[0] == 'S' || text[0] == 's')

&& (text[1] == 'E' || text[1] == 'e')

&& (text[2] == 'T' || text[2] == 't');