feat: allow to set a maximum amount of aliases while parsing to protect against billion laughs attack and similar

[Vampire]

No description provided.

[Vampire]

In the current code of the PR the cumulated alias weight of all nodes so far is used as a criterion.
An alternative could be to stop parsing if an individual node exceeds a given weight limit.

[charleskorn]

Is this necessary? YamlConfiguration already has a allowAnchorsAndAliases property that defaults to false. I think adding what is proposed here adds a lot of complexity and I worry that it provides a false sense of security.

[Vampire]

Yes, this is definitely necessary.

If you set allowAnchorsAndAliases to false you cannot use anchors and aliases.

If you need them and thus set it to true, you are one blink away from a DoS attack which is very trivial.

With this protection, the DoS attack is prevented. It is a similar protection e.g. snakeyaml has built in if you use the high-level API (you use the low-level one), or also the YAML NPM package.

[Vampire]

If you have a better idea for a protection, your welcome to not merge this and do that other idea instead of course. :-)

[charleskorn]

Two small suggestions, and then I think this is good to go!

[charleskorn]

@Vampire could you please fix the linting failure?

[Vampire]

Whoops, sorry, did the uglification now. :-)

[charleskorn]

Thanks @Vampire!

[github-actions]

🎉 This PR is included in version 0.64.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀