Validate number length when coercing StringNode to number

[aysha-afrah26]

A StringNode holding a stringified number coerces to BigInteger, BigDecimal, double or float through NumberInput.parseBigInteger/parseBigDecimal/parseDouble/parseFloat, but unlike the deserializer paths it never applies the StreamReadConstraints number-length check first. The value arrived as a JSON String, so it is bounded only by the max-string-length limit (20MB by default) and not by max-number-length (1000), which means mapper.readTree(input).get("v").asDecimal() on a multi-megabyte digit string runs the O(n^2) BigDecimal(String)/BigInteger(String) constructors and burns CPU on a single call. I noticed it while checking that the node-level number accessors line up with the guards BigIntegerDeserializer/BigDecimalDeserializer and StdDeserializer already apply, and with the scale-side guard DecimalNode/POJONode gained in databind#6214; the String parse path in StringNode was the one spot still unguarded. The fix follows databind#6214: the strict asBigInteger()/asDecimal()/asDouble()/asFloat() accessors go through the _tryParseAs... helpers, which now call validateIntegerLength/validateFPLength before parsing and so surface StreamConstraintsException, while the lenient default/Optional variants check the length up front and return their default/empty as their contract requires. No StreamReadConstraints is available at the node level, so this uses StreamReadConstraints.defaults(), same as the databind#6214 code. Values within the limit coerce exactly as before, and I kept the change inside StringNode so nothing else moves. Targeting 3.1 since the same code is present on 3.1, 3.2 and 3.x.

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	81.48%	📈 +0.000%
Branches	74.85%	📈 +0.000%

Coverage data generated from JaCoCo test results

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	81.48%	📈 +0.010%
Branches	74.85%	📈 +0.020%

Coverage data generated from JaCoCo test results

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · StringNode numeric coercions now enforce default limits and change overlong-value results

Adds StreamReadConstraints number-length validation to StringNode coercion methods (asBigInteger(), asDecimal(), asDouble(), asFloat()) to prevent O(n²) parsing on oversized digit strings. The strict accessors now reject values exceeding the max-number-length limit before parsing, while lenient variants return their defaults as specified. No issues found.

Review coverage

📋 Rules No rules evaluated

🧪 Functional validation Not enabled · Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}

[github-actions]

🧪 Code Coverage Report

Metric	Coverage	Change
Instructions	81.48%	📈 +0.010%
Branches	74.87%	📈 +0.040%

Coverage data generated from JaCoCo test results