bug #40707 [Yaml] Fixed infinite loop when parser goes through an additional and invalid closing tag (alexandre-daubois)

Nyholm · Nyholm · commit ed576b255445 · 2021-04-09T10:22:27.000+02:00
This PR was merged into the 4.4 branch. Discussion ---------- [Yaml] Fixed infinite loop when parser goes through an additional and invalid closing tag | Q | A | ------------- | --- | Branch? | 4.4 and above | Bug fix? | yes | New feature? | no  | Deprecations? | no  | Tickets | Fix #40706  | License | MIT | Doc PR |  Instead of letting the parser goes in an infinite loop because it can't get the right closing tag, throw an exception when the additional and invalid closing tag is found Commits ------- d5f8c88 [Yaml] Fixed infinite loop when parser goes through an additional and invalid closing tag
diff --git a/src/Symfony/Component/Yaml/Parser.php b/src/Symfony/Component/Yaml/Parser.php
@@ -1225,6 +1225,10 @@ private function lexUnquotedString(int &$cursor): string
         $offset = $cursor;
         $cursor += strcspn($this->currentLine, '[]{},: ', $cursor);
 
+        if ($cursor === $offset) {
+            throw new ParseException('Malformed unquoted YAML string.');
+        }
+
         return substr($this->currentLine, $offset, $cursor - $offset);
     }
 
diff --git a/src/Symfony/Component/Yaml/Tests/ParserTest.php b/src/Symfony/Component/Yaml/Tests/ParserTest.php
@@ -2676,6 +2676,25 @@ public function testParseValueWithNegativeModifiers()
         );
     }
 
+    public function testThrowExceptionIfInvalidAdditionalClosingTagOccurs()
+    {
+        $yaml = '{
+            "object": {
+                    "array": [
+                        "a",
+                        "b",
+                        "c"
+                    ]
+                ],
+            }
+        }';
+
+        $this->expectException(ParseException::class);
+        $this->expectExceptionMessage('Malformed unquoted YAML string at line 8 (near "                ],").');
+
+        $this->parser->parse($yaml);
+    }
+
     public function testWhitespaceAtEndOfLine()
     {
         $yaml = "\nfoo:\n    arguments: [ '@bar' ]  \n";

Original file line number	Diff line number	Diff line change
`@@ -1225,6 +1225,10 @@ private function lexUnquotedString(int &$cursor): string`
`1225`	`1225`	`$offset = $cursor;`
`1226`	`1226`	`$cursor += strcspn($this->currentLine, '[]{},: ', $cursor);`
`1227`	`1227`
	`1228`	`+ if ($cursor === $offset) {`
	`1229`	`+ throw new ParseException('Malformed unquoted YAML string.');`
	`1230`	`+ }`
	`1231`	`+`
`1228`	`1232`	`return substr($this->currentLine, $offset, $cursor - $offset);`
`1229`	`1233`	`}`
`1230`	`1234`