tomchristie/django-rest-framework — pull request #1903 by dlm (2014-09-25 01:05:10+00:00)
Title: Possible issue when serializing large numbers

When using a serializer in the context of the rest framework, a malicious user could send a large number as a string representation (In the example I use a small number, str(2**256), that is big enough for demonstration). Since the number is converted to an integer in fields.IntegerField.from_native function without checking the length of the input, the system can hang. One solution is to use a length validation before converting, however this seems a little messy. Similar concerns exist in FloatField and DecimalField .