allow passing in the MaxArity for the JsonSchemaVisitor

modules/docs/src/03-protocols/02-simple-rest-json/01-overview.md

@@ -78,6 +78,10 @@ The `SimpleRestJson` protocol supports 3 different union encodings :
 
 See the section about [unions](../../04-codegen/02-unions.md) for a detailed description.
 
+## Json Array Arity
+* By default there is a limit on the arity of an array, which is 1024. This is to prevent the server from being overloaded with a large array as this is a vector for attacks.
+* This limit can be changed by setting the maxArity `smithy4s.http4s.SimpleRestJsonBuilder.withMaxArity(.)` to the desired value.
+* an example can be seen in the [client example](03-client.md)
 ## Supported traits
 
 Here is the list of traits supported by `SimpleRestJson`

modules/docs/src/03-protocols/02-simple-rest-json/03-client.md

@@ -6,6 +6,7 @@ title: SimpleRestJson client
 The `smithy4s-http4s` module provides functions that transform low-level http4s clients into high-level stubs, provided the corresponding service definitions (in smithy) are annotated with the `alloy#simpleRestJson` protocol.
 - Uri is optional as it will default to http://localhost:8080
 In `build.sbt`
+- the max arity of json array decoder is 1024 by default, but can be changed by calling withMaxArity on the RestJsonBuilder object
 
 ```scala
 libraryDependencies ++= Seq(
@@ -33,9 +34,10 @@ object Clients {
     .uri(Uri.unsafeFromString("http://localhost"))
     .resource
 
-  // alternatively ...
+  // alternatively ... with setting the max arity to 2048
   def helloWorldClient2(http4sClient: Client[IO]) : Resource[IO, HelloWorldService[IO]] =
-    SimpleRestJsonBuilder(HelloWorldService)
+    SimpleRestJsonBuilder
+    .withMaxArity(2048)(HelloWorldService)
     .client(http4sClient)
       .uri(Uri.unsafeFromString("http://localhost"))
       .resource

modules/http4s/src/smithy4s/http4s/SimpleRestJsonBuilder.scala

@@ -19,12 +19,18 @@ package http4s
 
 import smithy4s.internals.InputOutput
 
-object SimpleRestJsonBuilder
+object SimpleRestJsonBuilder extends SimpleRestJsonBuilder(1024)
+
+class SimpleRestJsonBuilder(maxArity: Int)
     extends SimpleProtocolBuilder[alloy.SimpleRestJson](
       smithy4s.http.json.codecs(
         alloy.SimpleRestJson.protocol.hintMask ++ HintMask(
           InputOutput,
           IntEnum
-        )
+        ),
+        maxArity
       )
-    )
+    ) {
+  def withMaxArity(maxArity: Int): SimpleRestJsonBuilder =
+    new SimpleRestJsonBuilder(maxArity)
+}

modules/json/src/smithy4s/http/json/codecs.scala

@@ -27,8 +27,9 @@ import smithy4s.schema.SchemaVisitor
 import smithy4s.schema.CompilationCache
 
 final case class codecs(
-    hintMask: HintMask = codecs.defaultHintMask
-) extends JsonCodecAPI(codecs.schemaVisitorJCodec(_), Some(hintMask))
+    hintMask: HintMask = codecs.defaultHintMask,
+    maxArity: Int = codecs.defaultMaxArity
+) extends JsonCodecAPI(codecs.schemaVisitorJCodec(_, maxArity), Some(hintMask))
 
 object codecs {
 
@@ -43,13 +44,18 @@ object codecs {
       // TODO: add tests for `codecs` understanding int enums. Maybe pizza spec
       IntEnum
     )
+  val defaultMaxArity: Int = 1024
 
   private[smithy4s] def schemaVisitorJCodec(
-      cache: CompilationCache[JCodec]
+      cache: CompilationCache[JCodec],
+      maxArity: Int = defaultMaxArity
   ): SchemaVisitor[JCodec] =
-    new SchemaVisitorJCodec(maxArity = 1024, cache)
+    new SchemaVisitorJCodec(maxArity, cache)
 
   private[smithy4s] val schemaVisitorJCodec: SchemaVisitor[JCodec] =
-    new SchemaVisitorJCodec(maxArity = 1024, CompilationCache.nop[JCodec])
+    new SchemaVisitorJCodec(
+      maxArity = defaultMaxArity,
+      CompilationCache.nop[JCodec]
+    )
 
 }