@bufbuild/protobuf 2.12.0 → 2.13.0

package/dist/esm/from-binary.js

@@ -16,19 +16,18 @@ import { scalarZeroValue } from "./reflect/scalar.js";
 import { reflect } from "./reflect/reflect.js";
 import { BinaryReader, WireType } from "./wire/binary-encoding.js";
 import { varint32write } from "./wire/varint.js";
-// Default options for parsing binary data.
-const readDefaults = {
-    readUnknownFields: true,
-};
-function makeReadOptions(options) {
-    return options ? Object.assign(Object.assign({}, readDefaults), options) : readDefaults;
+/**
+ * @private Only exported for getExtension()
+ */
+export function makeReadContext(options) {
+    return Object.assign(Object.assign({ readUnknownFields: true, recursionLimit: 100 }, options), { depth: 0 });
 }
 /**
  * Parse serialized binary data.
  */
 export function fromBinary(schema, bytes, options) {
     const msg = reflect(schema, undefined, false);
-    readMessage(msg, new BinaryReader(bytes), makeReadOptions(options), false, bytes.byteLength);
+    readMessage(msg, new BinaryReader(bytes), makeReadContext(options), false, bytes.byteLength);
     return msg.message;
 }
 /**
@@ -41,7 +40,7 @@ export function fromBinary(schema, bytes, options) {
  * new data.
  */
 export function mergeFromBinary(schema, target, bytes, options) {
-    readMessage(reflect(schema, target, false), new BinaryReader(bytes), makeReadOptions(options), false, bytes.byteLength);
+    readMessage(reflect(schema, target, false), new BinaryReader(bytes), makeReadContext(options), false, bytes.byteLength);
     return target;
 }
 /**
@@ -52,8 +51,11 @@ export function mergeFromBinary(schema, target, bytes, options) {
  *
  * @private
  */
-function readMessage(message, reader, options, delimited, lengthOrDelimitedFieldNo) {
+function readMessage(message, reader, ctx, delimited, lengthOrDelimitedFieldNo) {
     var _a;
+    if (++ctx.depth > ctx.recursionLimit) {
+        throw new Error(`cannot decode ${message.desc} from binary: maximum recursion depth of ${ctx.recursionLimit} reached`);
+    }
     const end = delimited ? reader.len : reader.pos + lengthOrDelimitedFieldNo;
     let fieldNo;
     let wireType;
@@ -65,13 +67,15 @@ function readMessage(message, reader, options, delimited, lengthOrDelimitedField
         }
         const field = message.findNumber(fieldNo);
         if (!field) {
-            const data = reader.skip(wireType, fieldNo);
-            if (options.readUnknownFields) {
+            // Use remaining recursion budget for skipping nested groups
+            const recursionLimit = ctx.recursionLimit - ctx.depth;
+            const data = reader.skip(wireType, fieldNo, recursionLimit);
+            if (ctx.readUnknownFields) {
                 unknownFields.push({ no: fieldNo, wireType, data });
             }
             continue;
         }
-        readField(message, reader, field, wireType, options);
+        readField(message, reader, field, wireType, ctx);
     }
     if (delimited) {
         if (wireType != WireType.EndGroup || fieldNo !== lengthOrDelimitedFieldNo) {
@@ -81,11 +85,12 @@ function readMessage(message, reader, options, delimited, lengthOrDelimitedField
     if (unknownFields.length > 0) {
         message.setUnknown(unknownFields);
     }
+    ctx.depth--;
 }
 /**
- * @private
+ * @private Only exported for getExtension()
  */
-export function readField(message, reader, field, wireType, options) {
+export function readField(message, reader, field, wireType, ctx) {
     var _a;
     switch (field.fieldKind) {
         case "scalar":
@@ -101,7 +106,7 @@ export function readField(message, reader, field, wireType, options) {
                 if (ok) {
                     message.set(field, val);
                 }
-                else if (options.readUnknownFields) {
+                else if (ctx.readUnknownFields) {
                     const bytes = [];
                     varint32write(val, bytes);
                     const unknownFields = (_a = message.getUnknown()) !== null && _a !== void 0 ? _a : [];
@@ -115,18 +120,18 @@ export function readField(message, reader, field, wireType, options) {
             }
             break;
         case "message":
-            message.set(field, readMessageField(reader, options, field, message.get(field)));
+            message.set(field, readMessageField(reader, ctx, field, message.get(field)));
             break;
         case "list":
-            readListField(reader, wireType, message.get(field), options);
+            readListField(reader, wireType, message.get(field), ctx);
             break;
         case "map":
-            readMapEntry(reader, message.get(field), options);
+            readMapEntry(reader, message.get(field), ctx);
             break;
     }
 }
 // Read a map field, expecting key field = 1, value field = 2
-function readMapEntry(reader, map, options) {
+function readMapEntry(reader, map, ctx) {
     const field = map.field();
     let key;
     let val;
@@ -150,7 +155,7 @@ function readMapEntry(reader, map, options) {
                         val = reader.int32();
                         break;
                     case "message":
-                        val = readMessageField(reader, options, field);
+                        val = readMessageField(reader, ctx, field);
                         break;
                 }
                 break;
@@ -174,11 +179,11 @@ function readMapEntry(reader, map, options) {
     }
     map.set(key, val);
 }
-function readListField(reader, wireType, list, options) {
+function readListField(reader, wireType, list, ctx) {
     var _a;
     const field = list.field();
     if (field.listKind === "message") {
-        list.add(readMessageField(reader, options, field));
+        list.add(readMessageField(reader, ctx, field));
         return;
     }
     const scalarType = (_a = field.scalar) !== null && _a !== void 0 ? _a : ScalarType.INT32;
@@ -194,10 +199,10 @@ function readListField(reader, wireType, list, options) {
         list.add(readScalar(reader, scalarType, field.utf8Validation));
     }
 }
-function readMessageField(reader, options, field, mergeMessage) {
+function readMessageField(reader, ctx, field, mergeMessage) {
     const delimited = field.delimitedEncoding;
     const message = mergeMessage !== null && mergeMessage !== void 0 ? mergeMessage : reflect(field.message, undefined, false);
-    readMessage(message, reader, options, delimited, delimited ? field.number : reader.uint32());
+    readMessage(message, reader, ctx, delimited, delimited ? field.number : reader.uint32());
     return message;
 }
 function readScalar(reader, type, validateUtf8 = false) {

package/dist/esm/from-json.d.ts

@@ -17,33 +17,50 @@ export interface JsonReadOptions {
      * from JSON format.
      */
     registry?: Registry | undefined;
+    /**
+     * The maximum depth of nested messages to parse. If a message nests deeper
+     * than this limit, parsing fails with an error instead of exhausting the
+     * call stack. Defaults to 100.
+     */
+    recursionLimit: number;
 }
 /**
  * Parse a message from a JSON string.
+ *
+ * Duplicate keys are rejected.
  */
 export declare function fromJsonString<Desc extends DescMessage>(schema: Desc, json: string, options?: Partial<JsonReadOptions>): MessageShape<Desc>;
 /**
- * Parse a message from a JSON string, merging fields.
+ * Parse a message from a JSON string, merging fields into the target.
  *
  * Repeated fields are appended. Map entries are added, overwriting
  * existing keys.
  *
  * If a message field is already present, it will be merged with the
  * new data.
+ *
+ * Duplicate keys in the JSON are rejected, as in `fromJsonString`.
  */
 export declare function mergeFromJsonString<Desc extends DescMessage>(schema: Desc, target: MessageShape<Desc>, json: string, options?: Partial<JsonReadOptions>): MessageShape<Desc>;
 /**
  * Parse a message from a JSON value.
+ *
+ * Duplicate keys are rejected, but a value parsed by JSON.parse has already
+ * dropped duplicates (the last one wins). Use `fromJsonString` for strict
+ * duplicate-key checking.
  */
 export declare function fromJson<Desc extends DescMessage>(schema: Desc, json: JsonValue, options?: Partial<JsonReadOptions>): MessageShape<Desc>;
 /**
- * Parse a message from a JSON value, merging fields.
+ * Parse a message from a JSON value, merging fields into the target.
  *
  * Repeated fields are appended. Map entries are added, overwriting
  * existing keys.
  *
  * If a message field is already present, it will be merged with the
  * new data.
+ *
+ * Duplicate keys are rejected as in `fromJson`; use `mergeFromJsonString`
+ * for strict checking.
  */
 export declare function mergeFromJson<Desc extends DescMessage>(schema: Desc, target: MessageShape<Desc>, json: JsonValue, options?: Partial<JsonReadOptions>): MessageShape<Desc>;
 /**

package/dist/esm/from-json.js

@@ -21,38 +21,42 @@ import { protoSnakeCase } from "./reflect/names.js";
 import { base64Decode } from "./wire/base64-encoding.js";
 import { hasCustomJsonRepresentation, isWrapperDesc, anyPack, ListValueSchema, NullValue, StructSchema, ValueSchema, } from "./wkt/index.js";
 import { createExtensionContainer, setExtension } from "./extensions.js";
-// Default options for parsing JSON.
-const jsonReadDefaults = {
-    ignoreUnknownFields: false,
-};
-function makeReadOptions(options) {
-    return options ? Object.assign(Object.assign({}, jsonReadDefaults), options) : jsonReadDefaults;
+function makeReadContext(options) {
+    return Object.assign(Object.assign({ ignoreUnknownFields: false, recursionLimit: 100 }, options), { depth: 0 });
 }
 /**
  * Parse a message from a JSON string.
+ *
+ * Duplicate keys are rejected.
  */
 export function fromJsonString(schema, json, options) {
     return fromJson(schema, parseJsonString(json, schema.typeName), options);
 }
 /**
- * Parse a message from a JSON string, merging fields.
+ * Parse a message from a JSON string, merging fields into the target.
  *
  * Repeated fields are appended. Map entries are added, overwriting
  * existing keys.
  *
  * If a message field is already present, it will be merged with the
  * new data.
+ *
+ * Duplicate keys in the JSON are rejected, as in `fromJsonString`.
  */
 export function mergeFromJsonString(schema, target, json, options) {
     return mergeFromJson(schema, target, parseJsonString(json, schema.typeName), options);
 }
 /**
  * Parse a message from a JSON value.
+ *
+ * Duplicate keys are rejected, but a value parsed by JSON.parse has already
+ * dropped duplicates (the last one wins). Use `fromJsonString` for strict
+ * duplicate-key checking.
  */
 export function fromJson(schema, json, options) {
     const msg = reflect(schema);
     try {
-        readMessage(msg, json, makeReadOptions(options));
+        readMessage(msg, json, makeReadContext(options));
     }
     catch (e) {
         if (isFieldError(e)) {
@@ -66,17 +70,20 @@ export function fromJson(schema, json, options) {
     return msg.message;
 }
 /**
- * Parse a message from a JSON value, merging fields.
+ * Parse a message from a JSON value, merging fields into the target.
  *
  * Repeated fields are appended. Map entries are added, overwriting
  * existing keys.
  *
  * If a message field is already present, it will be merged with the
  * new data.
+ *
+ * Duplicate keys are rejected as in `fromJson`; use `mergeFromJsonString`
+ * for strict checking.
  */
 export function mergeFromJson(schema, target, json, options) {
     try {
-        readMessage(reflect(schema, target), json, makeReadOptions(options));
+        readMessage(reflect(schema, target), json, makeReadContext(options));
     }
     catch (e) {
         if (isFieldError(e)) {
@@ -113,82 +120,95 @@ function getJsonField(desc, jsonKey) {
     }
     return (_a = messageJsonFields.get(desc)) === null || _a === void 0 ? void 0 : _a.get(jsonKey);
 }
-function readMessage(msg, json, opts) {
+function readMessage(msg, json, ctx) {
     var _a;
-    if (tryWktFromJson(msg, json, opts)) {
+    if (++ctx.depth > ctx.recursionLimit) {
+        throw new Error(`cannot decode ${msg.desc} from JSON: maximum recursion depth of ${ctx.recursionLimit} reached`);
+    }
+    if (tryWktFromJson(msg, json, ctx)) {
+        ctx.depth--;
         return;
     }
     if (json == null || Array.isArray(json) || typeof json != "object") {
         throw new Error(`cannot decode ${msg.desc} from JSON: ${formatVal(json)}`);
     }
     const oneofSeen = new Map();
+    const fieldSeen = new Set();
     for (const [jsonKey, jsonValue] of Object.entries(json)) {
         const field = getJsonField(msg.desc, jsonKey);
         if (field) {
+            if (fieldSeen.has(field)) {
+                // The same field may be set by its proto name and its JSON name, or by
+                // a duplicate or unicode-escaped key that JSON.parse already collapsed.
+                // Checked before the null-skip below so that a null entry still counts.
+                throw new FieldError(field, "set multiple times");
+            }
+            fieldSeen.add(field);
+            if (field.oneof && jsonValue === null && field.fieldKind == "scalar") {
+                // see conformance test Required.Proto3.JsonInput.OneofFieldNull{First,Second}
+                continue;
+            }
             if (field.oneof) {
-                if (jsonValue === null && field.fieldKind == "scalar") {
-                    // see conformance test Required.Proto3.JsonInput.OneofFieldNull{First,Second}
-                    continue;
-                }
                 const seen = oneofSeen.get(field.oneof);
                 if (seen !== undefined) {
                     throw new FieldError(field.oneof, `oneof set multiple times by ${seen.name} and ${field.name}`);
                 }
                 oneofSeen.set(field.oneof, field);
             }
-            readField(msg, field, jsonValue, opts);
+            readField(msg, field, jsonValue, ctx);
         }
         else {
             let extension = undefined;
             if (jsonKey.startsWith("[") &&
                 jsonKey.endsWith("]") &&
                 // biome-ignore lint/suspicious/noAssignInExpressions: no
-                (extension = (_a = opts.registry) === null || _a === void 0 ? void 0 : _a.getExtension(jsonKey.substring(1, jsonKey.length - 1))) &&
+                (extension = (_a = ctx.registry) === null || _a === void 0 ? void 0 : _a.getExtension(jsonKey.substring(1, jsonKey.length - 1))) &&
                 extension.extendee.typeName === msg.desc.typeName) {
                 const [container, field, get] = createExtensionContainer(extension);
-                readField(container, field, jsonValue, opts);
+                readField(container, field, jsonValue, ctx);
                 setExtension(msg.message, extension, get());
             }
-            if (!extension && !opts.ignoreUnknownFields) {
+            if (!extension && !ctx.ignoreUnknownFields) {
                 throw new Error(`cannot decode ${msg.desc} from JSON: key "${jsonKey}" is unknown`);
             }
         }
     }
+    ctx.depth--;
 }
-function readField(msg, field, json, opts) {
+function readField(msg, field, json, ctx) {
     switch (field.fieldKind) {
         case "scalar":
             readScalarField(msg, field, json);
             break;
         case "enum":
-            readEnumField(msg, field, json, opts);
+            readEnumField(msg, field, json, ctx);
             break;
         case "message":
-            readMessageField(msg, field, json, opts);
+            readMessageField(msg, field, json, ctx);
             break;
         case "list":
-            readListField(msg.get(field), json, opts);
+            readListField(msg.get(field), json, ctx);
             break;
         case "map":
-            readMapField(msg.get(field), json, opts);
+            readMapField(msg.get(field), json, ctx);
             break;
     }
 }
-function readListOrMapItem(field, json, opts) {
+function readListOrMapItem(field, json, ctx) {
     if (field.scalar && json !== null) {
         return scalarFromJson(field, json);
     }
     if (field.message && !isResetSentinelNullValue(field, json)) {
         const msgValue = reflect(field.message);
-        readMessage(msgValue, json, opts);
+        readMessage(msgValue, json, ctx);
         return msgValue;
     }
     if (field.enum && !isResetSentinelNullValue(field, json)) {
-        return readEnum(field.enum, json, opts.ignoreUnknownFields);
+        return readEnum(field.enum, json, ctx.ignoreUnknownFields);
     }
     throw new FieldError(field, `${field.fieldKind === "list" ? "list item" : "map value"} must not be null`);
 }
-function readMapField(map, json, opts) {
+function readMapField(map, json, ctx) {
     if (json === null) {
         return;
     }
@@ -196,15 +216,20 @@ function readMapField(map, json, opts) {
     if (typeof json != "object" || Array.isArray(json)) {
         throw new FieldError(field, "expected object, got " + formatVal(json));
     }
+    const seen = new Set();
     for (const [jsonMapKey, jsonMapValue] of Object.entries(json)) {
         const key = mapKeyFromJson(field.mapKey, jsonMapKey);
-        const value = readListOrMapItem(field, jsonMapValue, opts);
+        if (seen.has(key)) {
+            throw new FieldError(field, `duplicate map key "${jsonMapKey}"`);
+        }
+        seen.add(key);
+        const value = readListOrMapItem(field, jsonMapValue, ctx);
         if (value !== tokenIgnoredUnknownEnum) {
             map.set(key, value);
         }
     }
 }
-function readListField(list, json, opts) {
+function readListField(list, json, ctx) {
     if (json === null) {
         return;
     }
@@ -213,27 +238,27 @@ function readListField(list, json, opts) {
         throw new FieldError(field, "expected Array, got " + formatVal(json));
     }
     for (const jsonItem of json) {
-        const value = readListOrMapItem(field, jsonItem, opts);
+        const value = readListOrMapItem(field, jsonItem, ctx);
         if (value !== tokenIgnoredUnknownEnum) {
             list.add(value);
         }
     }
 }
-function readMessageField(msg, field, json, opts) {
+function readMessageField(msg, field, json, ctx) {
     if (isResetSentinelNullValue(field, json)) {
         msg.clear(field);
         return;
     }
     const msgValue = msg.isSet(field) ? msg.get(field) : reflect(field.message);
-    readMessage(msgValue, json, opts);
+    readMessage(msgValue, json, ctx);
     msg.set(field, msgValue);
 }
-function readEnumField(msg, field, json, opts) {
+function readEnumField(msg, field, json, ctx) {
     if (isResetSentinelNullValue(field, json)) {
         msg.clear(field);
         return;
     }
-    const enumValue = readEnum(field.enum, json, opts.ignoreUnknownFields);
+    const enumValue = readEnum(field.enum, json, ctx.ignoreUnknownFields);
     if (enumValue !== tokenIgnoredUnknownEnum) {
         msg.set(field, enumValue);
     }
@@ -362,7 +387,8 @@ function scalarFromJson(field, json) {
 }
 /**
  * Try to parse a JSON value to a map key for the reflect API.
- *
+ * Canonicalizes 64-bit integers given as string, so that "01 and "1" are one
+ * key, and duplicates can raise an error.
  * Returns the input if the JSON value cannot be converted.
  */
 function mapKeyFromJson(type, jsonString) {
@@ -381,6 +407,14 @@ function mapKeyFromJson(type, jsonString) {
         case ScalarType.SFIXED32:
         case ScalarType.SINT32:
             return int32FromJson(jsonString);
+        case ScalarType.INT64:
+        case ScalarType.SINT64:
+        case ScalarType.SFIXED64:
+        case ScalarType.UINT64:
+        case ScalarType.FIXED64:
+            return /^-?0+$/.test(jsonString)
+                ? "0"
+                : jsonString.replace(/^(-?)0+(?=\d)/, "$1");
         default:
             return jsonString;
     }
@@ -409,9 +443,14 @@ function int32FromJson(json) {
     }
     return json;
 }
+/**
+ * Parse a JSON string, rejecting duplicate object keys (which JSON.parse would
+ * otherwise silently merge).
+ */
 function parseJsonString(jsonString, typeName) {
+    let json;
     try {
-        return JSON.parse(jsonString);
+        json = JSON.parse(jsonString);
     }
     catch (e) {
         const message = e instanceof Error ? e.message : String(e);
@@ -419,14 +458,91 @@ function parseJsonString(jsonString, typeName) {
         // @ts-expect-error we use the ES2022 error CTOR option "cause" for better stack traces
         { cause: e });
     }
+    checkDuplicateKeys(jsonString, typeName);
+    return json;
 }
-function tryWktFromJson(msg, jsonValue, opts) {
+/**
+ * Scan a JSON string for duplicate object member names at any depth, throwing
+ * if any are found. JSON.parse() silently keeps the last of duplicate keys, so
+ * this raw-string scan is the only way to reject them. It must only be called
+ * with a string that JSON.parse() has already accepted, so it can assume the
+ * input is well-formed.
+ */
+function checkDuplicateKeys(jsonString, typeName) {
+    // One Set of seen member names for each open object; arrays push null.
+    const stack = [];
+    // Whether the next string token is an object member name.
+    let expectKey = false;
+    let i = 0;
+    while (i < jsonString.length) {
+        switch (jsonString[i]) {
+            case "{":
+                stack.push(new Set());
+                expectKey = true;
+                i++;
+                break;
+            case "[":
+                stack.push(null);
+                expectKey = false;
+                i++;
+                break;
+            case "}":
+            case "]":
+                stack.pop();
+                expectKey = false;
+                i++;
+                break;
+            case ",":
+                expectKey = stack[stack.length - 1] != null;
+                i++;
+                break;
+            case ":":
+                expectKey = false;
+                i++;
+                break;
+            case '"': {
+                const open = i++;
+                let escaped = false;
+                while (i < jsonString.length) {
+                    if (jsonString[i] == "\\") {
+                        escaped = true;
+                        i += 2; // skip the backslash and the character it escapes
+                        continue;
+                    }
+                    if (jsonString[i] == '"') {
+                        break;
+                    }
+                    i++;
+                }
+                const close = i++;
+                const seen = stack[stack.length - 1];
+                if (expectKey && seen) {
+                    // Decode escapes (rare) so that, for example, a key written with a
+                    // unicode escape collides with the same key written literally.
+                    const name = escaped
+                        ? JSON.parse(jsonString.substring(open, close + 1))
+                        : jsonString.substring(open + 1, close);
+                    if (seen.has(name)) {
+                        throw new Error(`cannot decode message ${typeName} from JSON: duplicate object key "${name}"`);
+                    }
+                    seen.add(name);
+                }
+                expectKey = false;
+                break;
+            }
+            default:
+                i++;
+                break;
+        }
+    }
+}
+function tryWktFromJson(msg, jsonValue, ctx) {
     if (!msg.desc.typeName.startsWith("google.protobuf.")) {
         return false;
     }
     switch (msg.desc.typeName) {
         case "google.protobuf.Any":
-            anyFromJson(msg.message, jsonValue, opts);
+            anyFromJson(msg.message, jsonValue, ctx);
             return true;
         case "google.protobuf.Timestamp":
             timestampFromJson(msg.message, jsonValue);
@@ -438,13 +554,13 @@ function tryWktFromJson(msg, jsonValue, opts) {
             fieldMaskFromJson(msg.message, jsonValue);
             return true;
         case "google.protobuf.Struct":
-            structFromJson(msg.message, jsonValue);
+            structFromJson(msg.message, jsonValue, ctx);
             return true;
         case "google.protobuf.Value":
-            valueFromJson(msg.message, jsonValue);
+            valueFromJson(msg.message, jsonValue, ctx);
             return true;
         case "google.protobuf.ListValue":
-            listValueFromJson(msg.message, jsonValue);
+            listValueFromJson(msg.message, jsonValue, ctx);
             return true;
         default:
             if (isWrapperDesc(msg.desc)) {
@@ -460,7 +576,7 @@ function tryWktFromJson(msg, jsonValue, opts) {
             return false;
     }
 }
-function anyFromJson(any, json, opts) {
+function anyFromJson(any, json, ctx) {
     var _a;
     if (json === null || Array.isArray(json) || typeof json != "object") {
         throw new Error(`cannot decode message ${any.$typeName} from JSON: expected object but got ${formatVal(json)}`);
@@ -478,7 +594,7 @@ function anyFromJson(any, json, opts) {
     if (!typeName.length) {
         throw new Error(`cannot decode message ${any.$typeName} from JSON: "@type" is invalid`);
     }
-    const desc = (_a = opts.registry) === null || _a === void 0 ? void 0 : _a.getMessage(typeName);
+    const desc = (_a = ctx.registry) === null || _a === void 0 ? void 0 : _a.getMessage(typeName);
     if (!desc) {
         throw new Error(`cannot decode message ${any.$typeName} from JSON: ${typeUrl} is not in the type registry`);
     }
@@ -486,13 +602,13 @@ function anyFromJson(any, json, opts) {
     if (hasCustomJsonRepresentation(desc) &&
         Object.prototype.hasOwnProperty.call(json, "value")) {
         const value = json.value;
-        readMessage(msg, value, opts);
+        readMessage(msg, value, ctx);
     }
     else {
         const copy = Object.assign({}, json);
         // biome-ignore lint/performance/noDelete: <explanation>
         delete copy["@type"];
-        readMessage(msg, copy, opts);
+        readMessage(msg, copy, ctx);
     }
     anyPack(msg.desc, msg.message, any);
 }
@@ -558,17 +674,20 @@ function fieldMaskFromJson(fieldMask, json) {
         return protoSnakeCase(path);
     });
 }
-function structFromJson(struct, json) {
+function structFromJson(struct, json, ctx) {
     if (typeof json != "object" || json == null || Array.isArray(json)) {
         throw new Error(`cannot decode message ${struct.$typeName} from JSON ${formatVal(json)}`);
     }
     for (const [k, v] of Object.entries(json)) {
         const parsedV = create(ValueSchema);
-        valueFromJson(parsedV, v);
+        valueFromJson(parsedV, v, ctx);
         struct.fields[k] = parsedV;
     }
 }
-function valueFromJson(value, json) {
+function valueFromJson(value, json, ctx) {
+    if (++ctx.depth > ctx.recursionLimit) {
+        throw new Error(`cannot decode ${value.$typeName} from JSON: maximum recursion depth of ${ctx.recursionLimit} reached`);
+    }
     switch (typeof json) {
         case "number":
             value.kind = { case: "numberValue", value: json };
@@ -585,27 +704,28 @@ function valueFromJson(value, json) {
             }
             else if (Array.isArray(json)) {
                 const listValue = create(ListValueSchema);
-                listValueFromJson(listValue, json);
+                listValueFromJson(listValue, json, ctx);
                 value.kind = { case: "listValue", value: listValue };
             }
             else {
                 const struct = create(StructSchema);
-                structFromJson(struct, json);
+                structFromJson(struct, json, ctx);
                 value.kind = { case: "structValue", value: struct };
             }
             break;
         default:
             throw new Error(`cannot decode message ${value.$typeName} from JSON ${formatVal(json)}`);
     }
+    ctx.depth--;
     return value;
 }
-function listValueFromJson(listValue, json) {
+function listValueFromJson(listValue, json, ctx) {
     if (!Array.isArray(json)) {
         throw new Error(`cannot decode message ${listValue.$typeName} from JSON ${formatVal(json)}`);
     }
     for (const e of json) {
         const value = create(ValueSchema);
-        valueFromJson(value, e);
+        valueFromJson(value, e, ctx);
         listValue.values.push(value);
     }
 }