From 1948f3aceceb69a7e59784b694d54e43146848d7 Mon Sep 17 00:00:00 2001
From: Simon Hatt <hatt@google.com>
Date: Tue, 18 Aug 2026 14:19:32 +0200
Subject: [PATCH 1/2] Add depth parameter to json_decode in parseInput

---
 server/lib/Endpoint.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/lib/Endpoint.php b/server/lib/Endpoint.php
index a2930dd..13dabbe 100644
--- a/server/lib/Endpoint.php
+++ b/server/lib/Endpoint.php
@@ -35,10 +35,10 @@ public function setSetupFunction(?callable $new_setup_function): void {
 
     /** Override to handle custom requests. */
     public function parseInput(Request $request): mixed {
-        $input = json_decode($request->getContent(), true);
+        $input = json_decode($request->getContent(), true, depth: 512);
         // GET param `request`.
         if (!$input && $request->query->has('request')) {
-            $input = json_decode($request->get('request'), true);
+            $input = json_decode($request->get('request'), true, depth: 512);
         }
         return $input;
     }

From 4b590d73f73fe53f6ba3adf7b4af5ba9f4ed928e Mon Sep 17 00:00:00 2001
From: Simon Hatt <hatt@google.com>
Date: Tue, 18 Aug 2026 14:20:27 +0200
Subject: [PATCH 2/2] Set JSON decode depth to 512 in Translator.php

---
 server/lib/Translator.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/lib/Translator.php b/server/lib/Translator.php
index cc839ce..6d7fafe 100644
--- a/server/lib/Translator.php
+++ b/server/lib/Translator.php
@@ -126,7 +126,7 @@ protected function readMessagesJson(string $lang): array {
         if (!$messages_json_content) {
             return [];
         }
-        return json_decode($messages_json_content, true) ?? [];
+        return json_decode($messages_json_content, true, depth: 512) ?? [];
     }
 
     public static function getInstance(): Translator {