change(eval): use saphyr-parser to parse YAML and support anchors

CHANGELOG.md

@@ -4,7 +4,9 @@
 
 ### Breaking
 
-- Change how some plain YAML scalars are parsed in `std.parseYaml`:
+- Some semantics of `std.parseYaml` have changed:
+  - Empty YAML documents are now parsed as `null` instead of an empty string.
+  - Anchors and aliases are now supported.
   - `Null`, `NULL` and `~` are now parsed as `null`.
   - `True` and `TRUE` are now parsed as `true` .
   - `False` and `FALSE` are now parsed as `false`.
@@ -21,6 +23,7 @@
 - Avoid panic when encountering an array or object as object key in
   `std.parseYaml`.
 - Avoid panic when encountering a YAML alias in `std.parseYaml`.
+- Avoid some panics in `std.parseYaml` with some inputs found with fuzzing.
 
 ## 0.1.2 (2024-07-20)
 

rsjsonnet-lang/Cargo.toml

@@ -12,5 +12,5 @@ publish.workspace = true
 
 [dependencies]
 hashbrown = "0.14.5"
-libyaml-safer = "0.1.1"
 md-5 = { version = "0.10.6", default-features = false }
+saphyr-parser = "0.0.2"

rsjsonnet-lang/src/program/eval/mod.rs

@@ -1999,7 +1999,7 @@ impl<'a> Evaluator<'a> {
                 State::StdParseYaml => {
                     let arg = self.value_stack.pop().unwrap();
                     let s = self.expect_std_func_arg_string(arg, "parseYaml", 0)?;
-                    match parse_yaml::parse_yaml(self.program, &s, true) {
+                    match parse_yaml::parse_yaml(self.program, &s) {
                         Ok(value) => {
                             self.value_stack.push(value);
                         }