From aeb68285db2a919fc6174f5a65caf141c74e1ef5 Mon Sep 17 00:00:00 2001
From: Alex Kocharin <alex@kocharin.ru>
Date: Mon, 4 Nov 2019 17:39:14 +0300
Subject: [PATCH] Check the node type for !<?> tag in case user manually
 specifies it

---
 lib/js-yaml/loader.js | 14 ++++++++++----
 test/issues/0525-2.js | 16 ++++++++++++++++
 2 files changed, 26 insertions(+), 4 deletions(-)
 create mode 100644 test/issues/0525-2.js

diff --git a/lib/js-yaml/loader.js b/lib/js-yaml/loader.js
index 2815c955..3af04dcc 100644
--- a/lib/js-yaml/loader.js
+++ b/lib/js-yaml/loader.js
@@ -1393,13 +1393,19 @@ function composeNode(state, parentIndent, nodeContext, allowToSeek, allowCompact
 
   if (state.tag !== null && state.tag !== '!') {
     if (state.tag === '?') {
+      // Implicit resolving is not allowed for non-scalar types, and '?'
+      // non-specific tag is only automatically assigned to plain scalars.
+      //
+      // We only need to check kind conformity in case user explicitly assigns '?'
+      // tag, for example like this: "!<?> [0]"
+      //
+      if (state.result !== null && state.kind !== 'scalar') {
+        throwError(state, 'unacceptable node kind for !<?> tag; it should be "scalar", not "' + state.kind + '"');
+      }
+
       for (typeIndex = 0, typeQuantity = state.implicitTypes.length; typeIndex < typeQuantity; typeIndex += 1) {
         type = state.implicitTypes[typeIndex];
 
-        // Implicit resolving is not allowed for non-scalar types, and '?'
-        // non-specific tag is only assigned to plain scalars. So, it isn't
-        // needed to check for 'kind' conformity.
-
         if (type.resolve(state.result)) { // `state.result` updated in resolver if matched
           state.result = type.construct(state.result);
           state.tag = type.tag;
diff --git a/test/issues/0525-2.js b/test/issues/0525-2.js
new file mode 100644
index 00000000..3e4169ad
--- /dev/null
+++ b/test/issues/0525-2.js
@@ -0,0 +1,16 @@
+'use strict';
+
+
+var assert = require('assert');
+var yaml   = require('../../');
+
+
+test('Should check kind type when resolving !<?> tag', function () {
+  try {
+    yaml.safeLoad('!<?> [0]');
+  } catch (err) {
+    assert(err.stack.startsWith('YAMLException: unacceptable node kind for !<?> tag'));
+    return;
+  }
+  assert.fail(null, null, 'Expected an error to be thrown');
+});