Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make SnakeYAML's code point limit configurable #543

Merged
merged 1 commit into from
Apr 13, 2024

Conversation

sschuberth
Copy link
Contributor

Resolves #517.

@sschuberth
Copy link
Contributor Author

While this could be made configurable in the future, this is a quick fix to be able to handle YAML files that exceed 3 MB.

@charleskorn
Copy link
Owner

While this could be made configurable in the future, this is a quick fix to be able to handle YAML files that exceed 3 MB.

I would prefer the default limit remain in place, with an option to disable it - otherwise this is a potential denial of service vector.

@sschuberth
Copy link
Contributor Author

this is a potential denial of service vector.

I'm aware of the original motivation for this limit in upstream, but I only partly share the concerns. Also 3 MB seems really low as a limit.

Anyway, there doesn't seem to be an existing YamlParser configuration mechanism I could hook into, or? So making this configurable would become a larger refactoring, right?

@sschuberth
Copy link
Contributor Author

So making this configurable would become a larger refactoring, right?

Found a rather easy way via YamlConfiguration.

@sschuberth sschuberth changed the title Disable SnakeYAML's code point limit Make SnakeYAML's code point limit configurable Apr 11, 2024
@sschuberth
Copy link
Contributor Author

Thanks for the approval, can someone hit the merge button as well?

@charleskorn charleskorn merged commit eab051a into charleskorn:main Apr 13, 2024
1 check passed
@sschuberth sschuberth deleted the no-code-point-limit branch April 13, 2024 12:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Support loading files that exceed 3MiB
2 participants