Security - Unbounded recursion in deserialization

[EdwardCooke]

There is an unbounded security vulnerability in the default serializer.

Thanks to Igor to finding it.

Using the following code you will get a stack overflow exception.

using System;
using YamlDotNet.Serialization;

string yaml = new string('[', 100_000);              // deeply nested flow sequences
try
{
    new Deserializer().Deserialize<object>(yaml);    // crashes with StackOverflowException
}
catch (Exception)
{
    // never reached: a StackOverflowException is uncatchable and kills the process
}

[EdwardCooke]

This is now fixed, the default max recursion using the deserializer and deserializerbuilder is 475. Using the default serializer that is the maximum that will not throw an exception during testing.

[EdwardCooke]

Looks like Windows handles exceptions differently than Linux. The exceptions are placed on the stack, very interesting. This made the limit in tests for Windows actually bee 152 so that is what I set the default to.