SIGN IN SIGN UP

Updating maxValues to support roughly 200 bmcweb sessions

parseStringAsJson() routes through BmcwebSaxParse, which hard-caps a
payload at 500 total JSON values to defend against malicious external
HTTP request bodies.

The most visible symptom is that bmcweb silently loses every persisted
session across a restart once ~50 sessions accumulate (each persisted
session is ~11 JSON values, so the file trips the cap and is treated
as malformed).  Tntegration testing hit this 50 session limit and
failed. (Was failing our internal but also the
openbmc-test-automation robot suite)

I had originally implemented a solution as a "trusted reader"
with no limit
( https://gerrit.openbmc.org/c/openbmc/bmcweb/+/90138 ); however,
the security implications of "no limit" weren't attractive.
This area may be refactored in the near future to represent each
session as a distinct json file.  This value bump gets us past
the immediate needs without introducing a lot of churn in code
that will be refactored.

Change-Id: Ifd3514bd8ee15c8bdf1b6c2119451a2965801671
Signed-off-by: Rick Yazwinski <rickyaz@meta.com>
R
Rick Yazwinski committed
93ec859f5d20eef343ddc3f003cc2d36ec9dcb08
Parent: 1e2d826
Committed by Ed Tanous <ed@tanous.net> on 7/9/2026, 7:21:12 PM