Runtime Security Enhancements / Configs

[cawalch]

Security Enhancements

• max query depth - this allows setting (or using default) recursion depth limits to prevent stack overflow attacks through deeply nested queries

• max output size - set / default a max size of query results to prevent mem exhaustion

• execution time limit - query execution time limits to prevent Denial of Service (DoS) through complex queries (this might be better controlled by the caller, and avoiding support for features that could lead to excessive computational operations)

• function allow-listing - only allow specific built-in functions (e.g. exclude merge if obj manipulation is risky)