From a3a03efd9d34ca13de35bf28cdad23a7cf20b49c Mon Sep 17 00:00:00 2001
From: Andrew Paseltiner <apaseltiner@google.com>
Date: Tue, 20 May 2025 12:52:20 -0400
Subject: [PATCH] Allow implementations to reject large conversion-site lists

Otherwise, it is possible for a saveImpression call to consume unbounded
space.

We can consider imposing a minimum guaranteed size >= 1 later.
---
 api.bs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/api.bs b/api.bs
index aedae62..9396f71 100644
--- a/api.bs
+++ b/api.bs
@@ -1238,6 +1238,9 @@ The <dfn method for=PrivateAttribution>saveImpression(|options|)</dfn> method st
         throw a {{RangeError}}.
     1.  Clamp |options|.{{PrivateAttributionImpressionOptions/lifetimeDays}} to
         the [=user agent=]'s upper limit.
+    1.  If the [=list/size=] of
+        |options|.{{PrivateAttributionImpressionOptions/conversionSites}} is
+        greater than an [=implementation-defined=] maximum value, throw a {{RangeError}}.
     1.  Let |conversionSites| be the [=set=] that is the result
         of invoking [=parse a site=]
         for each value in |options|.{{PrivateAttributionImpressionOptions/conversionSites}}.