]> git.maquefel.me Git - brevno-suite/hugo/commit
Replace to gopkg.in/yaml with github.com/goccy/go-yaml (note)
authorBjørn Erik Pedersen <bjorn.erik.pedersen@gmail.com>
Fri, 17 Oct 2025 10:49:54 +0000 (12:49 +0200)
committerBjørn Erik Pedersen <bjorn.erik.pedersen@gmail.com>
Sat, 18 Oct 2025 11:52:22 +0000 (13:52 +0200)
commita3d9548469a4a37092e96c7d1b127c977f69d82f
treefb8e6e6b87648802b158c764f00d12c7288845f1
parent9e344bbe49668839fbc777de527098a2d419ee2f
Replace to gopkg.in/yaml with github.com/goccy/go-yaml (note)

This commit also adds validation to prevent the "Billion Laughs" attack (see https://github.com/goccy/go-yaml/issues/461). The limit of non-scalar aliases to the same node is set to 10,000. See benchmarks below.

```                                                            │        sec/op         │
UnmarshalBillionLaughs/Billion_Laughs_no_validation-10                 125.2µ ± ∞ ¹
UnmarshalBillionLaughs/Billion_Laughs_with_validation-10               655.8µ ± ∞ ¹
UnmarshalBillionLaughs/YAML_Front_Matter_no_validation-10              9.223µ ± ∞ ¹
UnmarshalBillionLaughs/YAML_Front_Matter_with_validation-10            9.443µ ± ∞ ¹
geomean                                                                51.71µ
¹ need >= 6 samples for confidence interval at level 0.95

                                                            │ fix-goyaml-8822.bench │
                                                            │         B/op          │
UnmarshalBillionLaughs/Billion_Laughs_no_validation-10                177.0Ki ± ∞ ¹
UnmarshalBillionLaughs/Billion_Laughs_with_validation-10              177.0Ki ± ∞ ¹
UnmarshalBillionLaughs/YAML_Front_Matter_no_validation-10             11.67Ki ± ∞ ¹
UnmarshalBillionLaughs/YAML_Front_Matter_with_validation-10           11.67Ki ± ∞ ¹
geomean                                                               45.45Ki
¹ need >= 6 samples for confidence interval at level 0.95

                                                            │ fix-goyaml-8822.bench │
                                                            │       allocs/op       │
UnmarshalBillionLaughs/Billion_Laughs_no_validation-10                 3.302k ± ∞ ¹
UnmarshalBillionLaughs/Billion_Laughs_with_validation-10               3.305k ± ∞ ¹
UnmarshalBillionLaughs/YAML_Front_Matter_no_validation-10               253.0 ± ∞ ¹
UnmarshalBillionLaughs/YAML_Front_Matter_with_validation-10             253.0 ± ∞ ¹
````

Fixes #8822
Fixes #13043
Fixes #14053
Fixes ##8427
21 files changed:
commands/gen.go
commands/server.go
common/herrors/file_error.go
common/herrors/line_number_extractors.go
common/herrors/line_number_extractors_test.go [new file with mode: 0644]
go.mod
go.sum
hugolib/alias_test.go
hugolib/frontmatter_test.go
hugolib/hugo_sites_build_errors_test.go
hugolib/page__content.go
hugolib/pages_capture.go
langs/i18n/translationProvider.go
parser/frontmatter.go
parser/metadecoders/decoder.go
parser/metadecoders/decoder_test.go
parser/metadecoders/encoder.go [new file with mode: 0644]
testscripts/commands/server__error_recovery_edit_content.txt
tpl/openapi/openapi3/openapi3.go
tpl/transform/remarshal_test.go
tpl/transform/transform_integration_test.go