[MAGNOLIA-8092] More than 50 aliases in a YAML file breaks parsing Created: 12/May/21  Updated: 04/Jul/22  Resolved: 16/Feb/22

Status: Closed
Project: Magnolia
Component/s: core
Affects Version/s: 6.2.8
Fix Version/s: 6.2.17

Type: Bug Priority: Neutral
Reporter: Chris Jennings Assignee: Milan Divilek
Resolution: Fixed Votes: 0
Labels: maintenance
Remaining Estimate: Not Specified
Time Spent: 0.25d
Original Estimate: Not Specified

Issue Links:
documentation
to be documented by MAGNOLIA-8285 DOC: More than 50 aliases in a YAML f... Closed
relation
is related to MAGNOLIA-7592 Removing decorations of module config... Closed
Template:
Acceptance criteria:
Empty
Task DoD:
[X]* Doc/release notes changes? Comment present?
[X]* Downstream builds green?
[X]* Solution information and context easily available?
[X]* Tests
[X]* FixVersion filled and not yet released
[ ]  Architecture Decision Record (ADR)
Bug DoR:
[X]* Steps to reproduce, expected, and actual results filled
[X]* Affected version filled
Documentation update required:
Yes
Date of First Response:
Epic Link: Support
Sprint: Global Maintenance 3, Global Maintenance 4, DevX 1, DevX 2, DevX 3, DevX 4
Story Points: 5
Team: DeveloperX

 Description   

Steps to reproduce

  1. Create a YAML file that features more than 50 aliases. Example.
  2. View the resulting object's definition.

Expected results

  1. The file is parsed and the definition is visible.

Actual results

  1. Due to a change in SnakeYAML 1.2.6 parsing is halted when the 51st alias is found so no definition is visible.

Workaround

  1. It is possible to use includes instead of aliases. The above example can be fixed this way.

Development notes

  1. The issue this solves is known as the Billion Laughs Attack. SnakeYAML was upgraded as part of MAGNOLIA-7912


 Comments   
Comment by Richard Gange [ 14/May/21 ]

Looks like there is a setter available. I guess we need to provide some way to set it. Maybe our properties file?

Comment by Richard Gange [ 20/Dec/21 ]

Just for the record there is a new property maxAliasesForCollectionsInYaml on the config node of the configuration module

Comment by Aleksandr Pchelintcev [ 21/Dec/21 ]

The proposed fix may provide the correct configuration, but deliberately turning YamlReader from a formerly fairly standalone utility into something that depends on Magnolia module registry and presence of ConfigModule in particular complicates a lot of things. Especially unit tests that involve YamlReader.

Comment by Robert Šiška [ 01/Feb/22 ]

akhamis It is supposed to be /modules/config/config/yamlReaderConfiguration/maxAliasesForCollectionsInYaml

Comment by Roman Kovařík [ 08/Feb/22 ]

What's the reason to put a new config into JCR? The configuration app as it is will be gone soon in favour of YAML configs.

Generated at Mon Feb 12 04:29:34 CET 2024 using Jira 9.4.2#940002-sha1:46d1a51de284217efdcb32434eab47a99af2938b.