Mihaela Mihaljevic
20b96fbfd4
enforceNestingLimit (Parser.Events.swift) bounds PHYSICAL collection depth in the raw event stream, since it counts sequenceStart/ mappingStart events directly. It does nothing against an anchor-expansion bomb: a handful of shallow, small anchors each aliased many times, each alias nested inside the next, keeps raw event depth at a constant 2 per line while the LOGICAL tree an alias resolves to grows exponentially in the number of alias levels. A 25-level, fan-out-9 document (~1.5KB) expands past 9^25 logical nodes; before this fix, parse accepted it in under 2ms, and any full-tree walk downstream (JSON representability checking, JSON writing, validation) never terminated. Added a total expanded-node budget, charged incrementally as the document streams through the composer rather than by walking anything: every scalar charges 1, every completed container charges 1 for its own wrapper (children already charged their own cost as they completed), and every alias resolution charges the target's CACHED expanded size -- computed once when the anchor was defined, looked up in O(1). This makes a nested bomb's true compounded size visible arithmetically within a few alias levels, without ever materializing or walking the exponential tree it would otherwise produce. A document with genuinely wide but non-exponential alias reuse (the same small anchor referenced thousands of times at one level, no nesting) stays comfortably inside the budget and parses normally. Verified via the full existing test suite (674 tests, all passing, zero regressions -- including the YAML Test Suite conformance corpus and the tagged round-trip corpus), two new tests proving the bomb is rejected (in under 2ms) and that wide non-exponential fan-out still parses, and swiftformat/swiftlint --strict clean on all five touched files. PureYAML.Parsing.EventComposer and Tagged.EventComposer (two other, separate composer implementations in this package, used by the diagnostic-validation and tagged-parsing entry points respectively) share the same architectural gap and would benefit from the same fix, but are not reachable from the confirmed exploit path this change closes -- disclosed, not fixed here.
22 lines
1.1 KiB
Swift
22 lines
1.1 KiB
Swift
extension PureYAML.Parsing {
|
|
struct EventStreamContainer {
|
|
var kind: EventStreamContainerKind
|
|
var anchor: String?
|
|
var values: [EventStreamComposedNode] = []
|
|
var mergeSources: [[PureYAML.Model.Pair]] = []
|
|
var localPairs: [PureYAML.Model.Pair] = []
|
|
var pendingKey: PureYAML.Parsing.EventComposer.ComposedMappingKey?
|
|
var mark: PureYAML.Parsing.Mark
|
|
/// The running sum of every child's own expanded-node cost (see
|
|
/// `EventStreamComposer.expandedNodeBudget`), so this container's total logical size --
|
|
/// itself plus every descendant, alias expansion already accounted for -- is available in
|
|
/// O(1) the moment it completes, without re-walking anything.
|
|
var logicalSize = 0
|
|
// Location tracking (parallel to the above, only when the composer tracks locations).
|
|
var locatedValues: [PureYAML.Model.LocatedValue] = []
|
|
var mergeLocatedSources: [[PureYAML.Model.LocatedPair]] = []
|
|
var localLocatedPairs: [PureYAML.Model.LocatedPair] = []
|
|
var pendingKeyNode: EventStreamComposedNode?
|
|
}
|
|
}
|