Skip to content

Commit

Permalink
fix: yaml resource exhaustion (#5127)
Browse files Browse the repository at this point in the history
### Description

Fixes 
```
ReferenceError: Excessive alias count indicates a resource exhaustion attack
```

See
https://stackoverflow.com/questions/63075256/why-does-the-npm-yaml-library-have-a-max-alias-number

### Backward compatibility

Yes

### Testing

Manual
  • Loading branch information
yorhodes authored Jan 8, 2025
1 parent 335f57d commit cd7c413
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 2 deletions.
5 changes: 5 additions & 0 deletions .changeset/shaggy-dolphins-wink.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
"@hyperlane-xyz/cli": patch
---

Fix yaml resource exhaustion
14 changes: 12 additions & 2 deletions typescript/cli/src/utils/files.ts
Original file line number Diff line number Diff line change
Expand Up @@ -4,16 +4,26 @@ import fs from 'fs';
import os from 'os';
import path from 'path';
import {
DocumentOptions,
LineCounter,
ParseOptions,
SchemaOptions,
ToJSOptions,
parse,
parse as yamlParse,
stringify as yamlStringify,
} from 'yaml';

import { objMerge } from '@hyperlane-xyz/utils';

import { log } from '../logger.js';

const yamlParse = (
content: string,
options?: ParseOptions & DocumentOptions & SchemaOptions & ToJSOptions,
) =>
// See stackoverflow.com/questions/63075256/why-does-the-npm-yaml-library-have-a-max-alias-number
parse(content, { maxAliasCount: -1, ...options });

export const MAX_READ_LINE_OUTPUT = 250;

export type FileFormat = 'yaml' | 'json';
Expand Down Expand Up @@ -250,7 +260,7 @@ export function logYamlIfUnderMaxLines(
): void {
const asYamlString = yamlStringify(obj, null, margin);
const lineCounter = new LineCounter();
parse(asYamlString, { lineCounter });
yamlParse(asYamlString, { lineCounter });

log(lineCounter.lineStarts.length < maxLines ? asYamlString : '');
}

0 comments on commit cd7c413

Please sign in to comment.