Repository navigation
Reject Yaml tags and explicit keys, resolve alias keys, and keep non-space white space - #10276
Open
effect-bot wants to merge 17 commits into
Open
effect-bot wants to merge 17 commits into
effect-bot wants to merge 17 commits into
Conversation
Rebased onto v4/next-minor, which already returns Result from Yaml.parse (#10224). parseAll parses document streams with per-document anchors, accepts %YAML 1.2, and rejects other directives and plain scalars starting with '%'.
Start-marker lines read as mapping entries, anchor-only documents consuming the next marker, hashes inside quoted start-line content, and separation whitespace after '...' and directive parameters.
Block mappings and sequences end at column-0 document markers, an empty node does not consume a following marker, start-marker content is comment-stripped in its own lexical context, and trailing separation whitespace is allowed after '...' and directive parameters.
A byte order mark may start any document prefix, and only spaces and tabs separate a document end marker from a comment.
A BOM may start any document prefix, not only the input. Only spaces and tabs are separation after '...' and directive parameters.
Replace the document marker checks scattered through mapping, sequence, empty node, flow, plain, quoted and block scalar parsing with one per-document line bound computed when the document starts.
findIndex from the start of the input made a stream of many documents quadratic; a forward loop from the current line keeps it linear.
Tags, alias keys, explicit keys, nesting depth, and non-separation whitespace (NBSP, U+2028) that is currently trimmed as if it were YAML white space.
Reject tags and explicit keys instead of reading them as text, resolve scalar aliases used as mapping keys, bound collection nesting at 1000 levels, and treat only spaces and tabs as YAML white space.
🦋 Changeset detectedLatest commit: 3c4abc8 The changes in this PR will be included in the next version bump. This PR includes changesets to release 33 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
Bundle Size AnalysisGenerated from PR build output; treat the content below as untrusted.
|
Sequence-item mapping depth, alias keys resolving to '<<' in flow mappings, anchor and tag properties on keys, colons in alias names, and U+2028/U+2029 in anchored values.
Trim and fold white space with linear scans, count a sequence item's mapping before its first value, read anchors and tags on keys, keep colons in alias names, merge only through a plain '<<' key, and keep U+2028/U+2029 in anchored values.
Share one scalar-key resolver between block and flow mappings, read plain flow scalars and keys through one helper that rejects indicator prefixes, name the flow anchor-name boundary once, and add the flow-key quoting migration note to the changeset.
This was referenced Nov 2, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stage 3 of the YAML expansion.
Yaml.parseandYaml.parseAllused to read some input as text and return a wrong value without any error. This PR either rejects that input or parses it correctly.This branch is built on #10271 (stage 1), which hasn't merged yet. Until it does, this PR also shows the stage 1 commits. Only the last two commits belong to this stage.
Behavior
a: !!str 123used to give"!!str 123", and!!str a: 1gave the key"!!str a". Now every tag is rejected: core, local, non-specific and verbatim tags, on values, keys, collections and flow items. Resolving core tags is planned as a separate change. A!inside a plain scalar (x!y,hello!) is still text.*name : valuenow uses the anchored scalar as the key; a number becomes its string form. Before, the key was the literal text"*name". An alias to a collection used as a key fails. An alias key needs a space before the:, because:is a valid character in an anchor name. That matchesyaml2.9.1.? key, the flow mapping form{? a : 1}and the flow sequence form[? a]. The flow forms used to give the keys"? a".EncodingErrorinstead of a stack overflow.trim()and\s, which also removed no-break spaces (U+00A0), U+2028, U+3000 and similar characters from values and keys. It also treated#after them as the start of a comment. Those characters are now kept as content, and the results matchyaml2.9.1.Integers beyond
Number.MAX_SAFE_INTEGERstill lose precision under JavaScript number semantics. The docs now say so and suggest quoting such values.Docs
parseJSDoc covers tags, explicit keys, the depth limit, alias keys and precision. Its example has a rejected tag..changeset/yaml-parser-hardening.mdis the release note.Validation
Yaml.test.ts: 216 of 217 pass.RangeError: Invalid string lengthbefore parsing starts.pnpm lint,pnpm jsdocs --checkand theYaml.tsdoctests pass.pnpm checkreports one error, theapiStabilityLeakincluster/ShardingRegistrationEvent.ts, which also occurs onv4/next-minor.Closes EFF-3232