Added maxTotalMergeKeys (10000) loader option (v5 backport)

Author: puzrin

CHANGELOG.md

@@ -6,6 +6,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 
+## 3.15.0 - Unreleased
+### Added
+- Added `maxTotalMergeKeys` (10000) loader option to limit the total number of
+  keys processed by YAML merge (`<<`) across one `safeLoad()` / `safeLoadAll()`
+  call.
+
+
 ## [3.14.2] - 2025-11-15
 ### Security
 - Fix prototype pollution in merge (<<).

README.md

@@ -117,6 +117,9 @@ options:
     http://yaml.org/type/
   - `DEFAULT_FULL_SCHEMA` - all supported YAML types.
 - `json` _(default: false)_ - compatibility with JSON.parse behaviour. If true, then duplicate keys in a mapping will override values rather than throwing an error.
+- `maxTotalMergeKeys` _(default: 10000)_ - limits the total number of keys
+  processed by merge (`<<`) across one `safeLoad()` / `safeLoadAll()` call. Set
+  to `-1` to disable.
 
 NOTE: This function **does not** understand multi-document sources, it throws
 exception on those.

lib/js-yaml/loader.js

@@ -154,6 +154,7 @@ function State(input, options) {
   this.legacy    = options['legacy']    || false;
   this.json      = options['json']      || false;
   this.listener  = options['listener']  || null;
+  this.maxTotalMergeKeys = typeof options['maxTotalMergeKeys'] === 'number' ? options['maxTotalMergeKeys'] : 10000;
 
   this.implicitTypes = this.schema.compiledImplicit;
   this.typeMap       = this.schema.compiledTypeMap;
@@ -163,6 +164,7 @@ function State(input, options) {
   this.line       = 0;
   this.lineStart  = 0;
   this.lineIndent = 0;
+  this.totalMergeKeys = 0;
 
   this.documents = [];
 
@@ -293,6 +295,10 @@ function mergeMappings(state, destination, source, overridableKeys) {
   for (index = 0, quantity = sourceKeys.length; index < quantity; index += 1) {
     key = sourceKeys[index];
 
+    if (state.maxTotalMergeKeys !== -1 && ++state.totalMergeKeys > state.maxTotalMergeKeys) {
+      throwError(state, 'merge keys exceeded maxTotalMergeKeys (' + state.maxTotalMergeKeys + ')');
+    }
+
     if (!_hasOwnProperty.call(destination, key)) {
       setProperty(destination, key, source[key]);
       overridableKeys[key] = true;

test/units/loader-parameters.js

@@ -3,6 +3,18 @@
 var assert = require('assert');
 var yaml = require('../..');
 
+function createMergeChain(count) {
+  var lines = [ 'a0: &a0 { k0: 0 }' ];
+  var i;
+
+  for (i = 1; i < count; i++) {
+    lines.push('a' + i + ': &a' + i + ' { <<: *a' + (i - 1) + ', k' + i + ': ' + i + ' }');
+  }
+
+  lines.push('b: *a' + (count - 1));
+  return lines.join('\n') + '\n';
+}
+
 suite('loader parameters', function () {
   var testStr = 'test: 1 \ntest: 2';
   var expected =  [ { test: 2 } ];
@@ -51,4 +63,51 @@ suite('loader parameters', function () {
     }, { json: true });
     assert.deepEqual(result, expected);
   });
+
+  test('maxTotalMergeKeys - caps total merge keys', function () {
+    function merge(n) {
+      var anchors = [];
+      var refs = [];
+      var i;
+
+      for (i = 0; i < n; i++) {
+        anchors.push('- &x' + i + ' {a' + i + ': ' + i + '}');
+        refs.push('*x' + i);
+      }
+
+      return anchors.join('\n') + '\n- <<: [' + refs.join(', ') + ']\n';
+    }
+
+    assert.doesNotThrow(function () {
+      yaml.safeLoad(merge(3), { maxTotalMergeKeys: 5 });
+    });
+    assert.throws(function () {
+      yaml.safeLoad(merge(3), { maxTotalMergeKeys: 2 });
+    }, /maxTotalMergeKeys/);
+    assert.doesNotThrow(function () {
+      yaml.safeLoad(merge(3), { maxTotalMergeKeys: -1 });
+    });
+
+    result = yaml.safeLoad(createMergeChain(150), { maxTotalMergeKeys: -1 });
+    assert.strictEqual(Object.keys(result.b).length, 150);
+  });
+
+  test('safeLoadAll - maxTotalMergeKeys is shared across all documents', function () {
+    var src = [
+      '---',
+      'a: &a { k1: 1, k2: 2 }',
+      'b: { <<: *a }',
+      '---',
+      'a: &a { k1: 1, k2: 2 }',
+      'b: { <<: *a }',
+      ''
+    ].join('\n');
+
+    assert.doesNotThrow(function () {
+      yaml.safeLoadAll(src, { maxTotalMergeKeys: 4 });
+    });
+    assert.throws(function () {
+      yaml.safeLoadAll(src, { maxTotalMergeKeys: 3 });
+    }, /maxTotalMergeKeys/);
+  });
 });