pub const MAX_YAML_NESTING_DEPTH: usize = 64;Expand description
Maximum allowed nesting depth for YAML block/flow recursion before
check_yaml_nesting_depth rejects the input.
yaml-rust2 0.12’s block-style (indentation-driven) sequence/mapping
parser recurses once per nesting level with no depth limit (its flow-style
[[[...]]] array parser already caps recursion, but block style and flow
objects do not). A deeply nested pubspec.yaml/pubspec.lock can overflow
the native thread stack and abort the whole process (SIGABRT) before
YamlLoader::load_from_str ever returns an error. As with
MAX_TOML_NESTING_DEPTH, this constant assumes the smallest stack any
caller is likely to run on: a tokio worker thread’s 2 MiB default, not
deps-lsp’s own 8 MiB WORKER_THREAD_STACK_SIZE (defense-in-depth on top
of this guard).
Bisected against the real yaml-rust2 0.12 recursion on a 2 MiB debug
stack: the cheapest attack — compact block-sequence chaining
(- - - - 1, 2 bytes per level) — survives depth 4535 and aborts at 4536;
growing-indent block mappings (k:\n k:\n k:\n...), the tightest case,
survive depth 1993 and abort at 1994. 64 leaves a >30x margin under the
tightest of these while still being far deeper than any real manifest
needs — pubspec.yaml/pubspec.lock structures bottom out around 4-5
levels (e.g. packages.<name>.description.<field>).