4 ms·

YAML is acutally trivially compatible with this exploit, in a sense, though the result is not particularly disastrous with Psych. lol1: &lol1 "lol"

by burke 14y ago

YAML is acutally trivially compatible with this exploit, in a sense, though the result is not particularly disastrous with Psych. lol1: &lol1 "lol" lol2: &lol2 [*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1,*lol1] lol3: &lol3 [*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2,*lol2] lol4: &lol4 [*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3,*lol3] lol5: &lol5 [*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4,*lol4] lol6: &lol6 [*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5,*lol5] lol7: &lol7 [*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6,*lol6] lol8: &lol8 [*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7,*lol7] lol9: &lol9 [*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8,*lol8]

koenigdavidmj 14y ago
That is probably not affected, as it's not necessary that each copy of lol1 inside lol2 actually be a copy. They could simply all be references to the same node. In fact, I don't even think that is legal for them to be copies, as this is the means by which YAML allows circular data structures to be represented.
clarkevans 14y ago
In YAML, this is 9 objects in memory, one of them is a scalar, the other 8 are arrays of size 10 that happen to be pointers to the other objects. Not very big at all... much less than 1k. It's not even interesting since YAML competently serializes graphs that are far more complex. Lots of reasons to trash YAML, this isn't one of them. As aardvark179 noted, a usage concern with YAML is more with how an unguarded application might fail to check for serialized graph cycles.
- gurkendoktor 14y ago
  > Lots of reasons to trash YAML, this isn't one of them. Is there a list of these reasons? Apart from graph cycles, I have only come across some gotchas (e.g. using "yes" without quotes in a translation file).
- burke 14y ago
  That makes sense. I tested this in a REPL that tried to pretty-print the result.

by burke 14y ago

koenigdavidmj 14y ago

That is probably not affected, as it's not necessary that each copy of lol1 inside lol2 actually be a copy. They could simply all be references to the same node. In fact, I don't even think that is legal for them to be copies, as this is the means by which YAML allows circular data structures to be represented.

clarkevans 14y ago

In YAML, this is 9 objects in memory, one of them is a scalar, the other 8 are arrays of size 10 that happen to be pointers to the other objects. Not very big at all... much less than 1k. It's not even interesting since YAML competently serializes graphs that are far more complex. Lots of reasons to trash YAML, this isn't one of them. As aardvark179 noted, a usage concern with YAML is more with how an unguarded application might fail to check for serialized graph cycles.

gurkendoktor 14y ago
> Lots of reasons to trash YAML, this isn't one of them. Is there a list of these reasons? Apart from graph cycles, I have only come across some gotchas (e.g. using "yes" without quotes in a translation file).
burke 14y ago
That makes sense. I tested this in a REPL that tried to pretty-print the result.