Add a decoder option to limit the number of unmarshalled values

[simonferquel]

This PR gives user code the opportunity to limit the number of values unmarshalled while decoding a yaml payload.

This is very usefull to protect programs from malicious external yaml documents such as these:

version: "3" 
services: &services ["lol","lol","lol","lol","lol","lol","lol","lol","lol"] 
b: &b [*services,*services,*services,*services,*services,*services,*services,*services,*services] 
c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b] 
d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c] 
e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d] 
f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e] 
g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f] 
h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g] 
i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]

This is a valid document, but parsing this will crash the program with an out of memory panic at some point.

[silvin-lubecki]

c.Assert(err, IsNil)

[silvin-lubecki]

typo: s/modyfy/modify

[simonferquel]

@silvin-lubecki fixed, thanks :)

[thaJeztah]

ping @rogpeppe @niemeyer PTAL

[tedyu]

@rogpeppe @niemeyer
Can you review this ?

The fix would help mitigate the CVE linked above.

[niemeyer]

The issue has been addressed in v3 without additional API changes. The proper fix for v2 would be to backport that over. Closing this one on that basis.

[thaJeztah]

@niemeyer do you know which PR fixed it in v3? Happy to open a backport/cherry-pick (if possible)

[niemeyer]

@thaJeztah Thanks! That was addressed with caeefd8

[niemeyer]

It's been backported to v2 with bb4e33b.

[omeid]

You literally copied his contribution without attribution. While it would have been best if the commit was cherry-picked, but the least @simonferquel should get credited for this fix.

[niemeyer]

His proposal:

https://github.com/go-yaml/yaml/pull/375/files

What was committed:

caeefd8

Enjoy your day.

[simonferquel]

Don't fight over me and this PR please, I don't care if I am mentioned in anything. This commit just allowed to workaround the issue for a project I had, and I made a PR in case it could help others.

[thaJeztah]

@omeid the implementation that was merged is different; this PR suggested a configurable limit, whereas the code merged has a hard coded limit.

The test case looks similar, because both are based on the same YAML exploit (the example can be found on WikiPedia: https://en.m.wikipedia.org/wiki/Billion_laughs_attack)

That said, it would've been nice if this PR had gotten attention earlier.

[niemeyer]

@simonferquel You are right, and your help was appreciated. Even if we got something else in, you gave a plave for people to organize around the issue and think about it. Thank you.

[niemeyer]

@thaJeztah Yeah, it's internally handled, but it's not quite hardcoded. We consider the percentage of aliases in the overall document. And we also look at the depth since that's where the issue happens. You are also right that this should have been looked into before.