From ec1db446cb825ec5da96bdcc38f675a8342d02f6 Mon Sep 17 00:00:00 2001 From: Edward Cooke Date: Sun, 21 Jun 2026 20:20:21 -0600 Subject: [PATCH] Static deserializer builder needed the default maximum recursion --- YamlDotNet/Serialization/StaticDeserializerBuilder.cs | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/YamlDotNet/Serialization/StaticDeserializerBuilder.cs b/YamlDotNet/Serialization/StaticDeserializerBuilder.cs index ff9b49b4d..361aa7ee0 100644 --- a/YamlDotNet/Serialization/StaticDeserializerBuilder.cs +++ b/YamlDotNet/Serialization/StaticDeserializerBuilder.cs @@ -121,6 +121,8 @@ public StaticDeserializerBuilder(StaticContext context) { typeof(PreventUnknownTagsNodeTypeResolver), _ => new PreventUnknownTagsNodeTypeResolver() }, { typeof(DefaultContainersNodeTypeResolver), _ => new DefaultContainersNodeTypeResolver() } }; + + maximumRecursion = 130; } protected override StaticDeserializerBuilder Self { get { return this; } } @@ -459,11 +461,16 @@ public IValueDeserializer BuildValueDeserializer() } /// - /// Sets the maximum recursion that is allowed while deserializing. + /// Sets the maximum recursion that is allowed while building the object graph. Must be > 0. Default is 130. /// /// /// Setting this limit is strongly recommended when parsing untrusted input since - /// deeply nested objects will lead to a stack overflow. + /// deeply nested objects will lead to a stack overflow. When using the default configuration + /// on Windows the maximum you should allow is ~130 as anything over that will lead to a stack overflow + /// when the max recursion exception is thrown. Linux OS allows for ~475 with .net 10 and the exception will be + /// thrown correctly without causing a stack overflow. This does not take into account the depth of + /// your application call stack. This is if YamlDotNet is called from the top of the stack. Windows with + /// .NET 8 only allows for ~130. On .NET 10 and Windows you can safely use ~152. /// public StaticDeserializerBuilder WithMaximumRecursion(int maximumRecursion) {