[Yaml] Fixed infinite loop when parser goes through an additional and invalid closing tag

alexandre-daubois · alexandre-daubois · commit 08b1da90d81b · 2021-04-04T20:43:43.000+02:00
Instead of letting the parser goes in an infinite loop, throw an exception when the additional and invalid is found
diff --git a/src/Symfony/Component/Yaml/Parser.php b/src/Symfony/Component/Yaml/Parser.php
@@ -1225,6 +1225,10 @@ private function lexUnquotedString(int &$cursor): string
         $offset = $cursor;
         $cursor += strcspn($this->currentLine, '[]{},: ', $cursor);
 
+        if ($cursor === $offset) {
+            throw new ParseException('Malformed unquoted YAML string');
+        }
+
         return substr($this->currentLine, $offset, $cursor - $offset);
     }
 
diff --git a/src/Symfony/Component/Yaml/Tests/ParserTest.php b/src/Symfony/Component/Yaml/Tests/ParserTest.php
@@ -2676,6 +2676,25 @@ public function testParseValueWithNegativeModifiers()
         );
     }
 
+    public function testThrowExceptionIfInvalidAdditionalClosingTagOccurs()
+    {
+        $yaml = '{
+            "object": {
+                    "array": [
+                        "a",
+                        "b",
+                        "c"
+                    ]
+                ],
+            }
+        }';
+
+        $this->expectException(ParseException::class);
+        $this->expectExceptionMessage('Malformed unquoted YAML string at line 8 (near "                ],")');
+
+        $this->parser->parse($yaml);
+    }
+
     public function testWhitespaceAtEndOfLine()
     {
         $yaml = "\nfoo:\n    arguments: [ '@bar' ]  \n";

Original file line number	Diff line number	Diff line change
`@@ -1225,6 +1225,10 @@ private function lexUnquotedString(int &$cursor): string`
`1225`	`1225`	`$offset = $cursor;`
`1226`	`1226`	`$cursor += strcspn($this->currentLine, '[]{},: ', $cursor);`
`1227`	`1227`
	`1228`	`+ if ($cursor === $offset) {`
	`1229`	`+ throw new ParseException('Malformed unquoted YAML string');`
	`1230`	`+ }`
	`1231`	`+`
`1228`	`1232`	`return substr($this->currentLine, $offset, $cursor - $offset);`
`1229`	`1233`	`}`
`1230`	`1234`