go-yaml / yaml

YAML support for the Go language.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Providing a way to disable the "excessive aliasing" check

jwright-stripe opened this issue · comments

Hi there!

Thanks so much for all your great work on this library.

I have a use case where I have to parse trusted configurations in the following format:

default_settings: &default
  important_items:
    - some
    - really
    - really
    - really
    - long
    - list
    - of
    - items

specific_environment:
   << *default

Occasionally, the structure of these configurations can trigger the heuristic for excessive aliasing, resulting in the error:

yaml: document contains excessive aliasing

I completely understand the goal of this is to prevent untrusted YAML from exploiting the "billion laughs" attack. In this case though, I'm parsing completely trusted YAML that's juuuust aliased enough to trigger the heuristic ratios.

This is a bit of a duplicate of #558, but I'd like to limit my focus a bit to see if y'all would be open to providing some kind of option to disable this checking. Since the values used for this heuristic are a bit fuzzy, as I'm seeing there are occasionally valid instances in which I trip the alarm so to speak, and wish there were a way for me to turn it off.

I'd be open to helping out here! If y'all would be open to some kind of an option here, then I think the question is where to put that option. In my head, I'm envisioning something similar to the existing Decoder.KnownOptions function where it sets an internal option if and only if it's used.