You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Found 2026-09-08 while verifying #435. Not caused by that PR; it exists on main. #435 widens the
exposure from the 64 KiB prefix to the whole file, since detection there parses the entire
document when the prefix does not answer.
Why
Detect (compilers/openapi/detect.go) fully decodes the mapping with yaml.Unmarshal just to
read the openapi / swagger key.
yaml.v3's duplicate-key error is quadratic in size. Measured in isolation:
204 duplicates → 1.1 MB error string; 819 → 18.7 MB; 1,638 → 76 MB (each doubling ×4).
diag.OneLine (compilers/openapi/internal/diag/diag.go) copies the entire parser error into the openapi/undecodable-source diagnostic message, with no length cap. The CLI then prints it.
Fix ideas
Cap the length of a parser error quoted into a diagnostic (first line, or first N bytes, plus "…").
What happens
A YAML spec with many duplicate top-level keys makes
morphic validateeither emit a giganticdiagnostic or never finish.
main(3d40d98)x: ylinesFound 2026-09-08 while verifying #435. Not caused by that PR; it exists on
main. #435 widens theexposure from the 64 KiB prefix to the whole file, since detection there parses the entire
document when the prefix does not answer.
Why
Detect(compilers/openapi/detect.go) fully decodes the mapping withyaml.Unmarshaljust toread the
openapi/swaggerkey.204 duplicates → 1.1 MB error string; 819 → 18.7 MB; 1,638 → 76 MB (each doubling ×4).
diag.OneLine(compilers/openapi/internal/diag/diag.go) copies the entire parser error into theopenapi/undecodable-sourcediagnostic message, with no length cap. The CLI then prints it.Fix ideas
This is the same change the fix(compilers/openapi): detect a version key past the sniff cap #435 review asks for.
Reproduce