Skip to content

Added default maximum recursion level of 130 (max when using defaults on Windows/.net8)#1110

Merged
EdwardCooke merged 4 commits into
aaubry:masterfrom
EdwardCooke:ec-security
Jun 22, 2026
Merged

Added default maximum recursion level of 130 (max when using defaults on Windows/.net8)#1110
EdwardCooke merged 4 commits into
aaubry:masterfrom
EdwardCooke:ec-security

Conversation

@EdwardCooke

Copy link
Copy Markdown
Collaborator

Fixes #1109

Copilot AI review requested due to automatic review settings June 21, 2026 20:49

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses issue #1109 by adding a default maximum recursion limit to deserialization, preventing deeply nested YAML from causing an uncatchable StackOverflowException and terminating the process.

Changes:

  • Set a default maximumRecursion value in DeserializerBuilder so the default deserializer configuration enforces a recursion cap.
  • Added recursion-level seeding in Deserializer.Deserialize(IParser, Type, int) and introduced an overload that uses a default value.
  • Added a unit test to verify a MaximumRecursionLevelReachedException is thrown for extremely deep nesting.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File Description
YamlDotNet/Serialization/DeserializerBuilder.cs Sets a default max recursion limit in the default deserializer builder configuration.
YamlDotNet/Serialization/Deserializer.cs Adds a new overload/signature for Deserialize and seeds recursion state for limit enforcement.
YamlDotNet.Test/Serialization/DeserializerTest.cs Adds a regression test covering default recursion limit behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread YamlDotNet/Serialization/Deserializer.cs
Comment thread YamlDotNet/Serialization/Deserializer.cs Outdated
Comment thread YamlDotNet/Serialization/Deserializer.cs Outdated
Comment thread YamlDotNet.Test/Serialization/DeserializerTest.cs
@EdwardCooke EdwardCooke changed the title Added default maximum recursion level of 475 (max when using defaults) Added default maximum recursion level of 152 (max when using defaults on Windows) Jun 21, 2026

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

Comment thread YamlDotNet.Test/Serialization/DeserializerTest.cs
Comment thread YamlDotNet/Serialization/DeserializerBuilder.cs
Comment thread YamlDotNet/Serialization/DeserializerBuilder.cs
@EdwardCooke EdwardCooke changed the title Added default maximum recursion level of 152 (max when using defaults on Windows) Added default maximum recursion level of 130 (max when using defaults on Windows/.net8) Jun 22, 2026
@EdwardCooke EdwardCooke merged commit 7de88b2 into aaubry:master Jun 22, 2026
3 checks passed
This was referenced Jun 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Security - Unbounded recursion in deserialization

2 participants