Restore validateIntegerLength() check in _decodeBigInt - #680
Merged
cowtowncoder merged 3 commits intoMay 25, 2026
Merged
Conversation
The 3.x YAMLParser._decodeBigInt routes the input string straight to NumberInput.parseBigInteger / parseBigIntegerWithRadix without first running it through StreamReadConstraints.validateIntegerLength, which means the configured maxNumberLength cap does not constrain integer literals that exit through this path (notably hex / octal / binary radix scalars and any decimal scalars reaching this helper). This change adds the length check at the top of the method, matching the 2.x implementation and the surrounding number-validation helpers in the same file. Adds regression coverage for decimal, hex, octal, and binary !!int literals against a YAMLFactory configured with maxNumberLength(1000).
cowtowncoder
added
yaml
cowtowncoder
changed the title
validateIntegerLength() check in _decodeBigInt
🧪 Code Coverage Report
|
🧪 Code Coverage Report
|
cowtowncoder
pushed a commit
that referenced
this pull request
May 25, 2026
cowtowncoder
added a commit
that referenced
this pull request
May 25, 2026
Member
|
Thank you @tonghuaroot ! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On the 3.x branch,
YAMLParser._decodeBigIntroutes its input string straight toNumberInput.parseBigInteger/parseBigIntegerWithRadixwithout first running it throughStreamReadConstraints.validateIntegerLength. The configuredmaxNumberLengthcap therefore does not constrain integer literals that exit through this helper, including hex / octal / binary!!intradix scalars and any decimal scalar long enough to fall through to it.This change adds the length check at the top of the method, mirroring the 2.x implementation and the surrounding number-validation helpers (
_cleanYamlInt,_cleanYamlFloat) in the same file.Regression coverage added in
IntegerLengthRadixTestfor decimal, hex, octal, and binary!!intliterals against aYAMLFactoryconfigured withmaxNumberLength(1000). Three of the four cases fail before the patch and pass after; the decimal one already passed via the existing_cleanYamlIntcheck and is included as a sanity guard.2.x already has this check, so no backport is needed.