Repository navigation
Add bounded parsing support for large exponent inputs #115
Description
Summary
BigNumber::of() accepts scientific notation and expands positive exponents into the unscaled integer representation. A small untrusted input can therefore cause a very large allocation.
Reproduction
BigNumber::of('1e1000000000');The parser expands the value with str_repeat('0', $zeros). Depending on the PHP memory limit, this can exhaust worker memory or terminate the process.
Impact
Applications that parse externally supplied values through BigNumber::of() can be exposed to input-amplification denial of service. Input-length limits alone do not mitigate this, because the triggering input can be very short.
Proposal
Add an opt-in bounded parsing API or parse context that can limit:
- Input length
- Absolute exponent
- Expanded digit count and/or resulting scale
For example, conceptually:
BigNumber::of(
'1e1000000000',
parseLimits: new NumberParseLimits(
maxInputLength: 256,
maxExponent: 1_000,
maxExpandedDigits: 10_000,
),
);The parser should throw NumberFormatException when a limit is exceeded.
An opt-in API preserves arbitrary-precision use cases while allowing HTTP, GraphQL, and CLI boundaries to safely parse untrusted input.
Workaround
Callers should reject exponent notation or independently bound exponent magnitude before calling BigNumber::of().
Reported against Brick Math 0.19.0.
Activity
BenMorel commentedon Aug 9, 2026
Hi @simPod,
I agree that this is an issue that should be fixed in the library itself, in particular due to the materialization of large exponents.
However, I think the API as proposed is not a good fit:
of()acceptsintandBigNumberas well, whereas the limits really only make sense for untrustedstringinputsNumberParseLimitsmakes the job harder for the caller, where a single "max digits" number would doI propose adding the following methods instead:
Implementation in #116.
Please let me know what you think!
BenMorel commentedon Aug 26, 2026
Implemented.
ofUntrusted()has been renamed toparse(), and you can now control the allowed syntax as well (decimal, exponent, fraction). The new signature is:BenMorel commentedon Aug 28, 2026
Released in version 0.20.0.