feat: make YAML conversion limits configurable

Expose YamlConverter.MaxDepth and MaxNodeCount as public static properties
(defaulting to DefaultMaxDepth=64 and DefaultMaxNodeCount=5,000,000) so
consumers can raise the limits for legitimately large/deep documents or lower
them to fail faster on known-small inputs, without needing a library change.
Setters validate that the value is greater than zero. Public API entries added.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 022bbd4f-e5e7-447a-bcdf-b2a4efaf75c3

Author: Treicy Sanchez Gutierrez (from Dev Box)

src/Microsoft.OpenApi.YamlReader/PublicAPI.Unshipped.txt

@@ -1 +1,7 @@
 #nullable enable
+const Microsoft.OpenApi.YamlReader.YamlConverter.DefaultMaxDepth = 64 -> int
+const Microsoft.OpenApi.YamlReader.YamlConverter.DefaultMaxNodeCount = 5000000 -> int
+static Microsoft.OpenApi.YamlReader.YamlConverter.MaxDepth.get -> int
+static Microsoft.OpenApi.YamlReader.YamlConverter.MaxDepth.set -> void
+static Microsoft.OpenApi.YamlReader.YamlConverter.MaxNodeCount.get -> int
+static Microsoft.OpenApi.YamlReader.YamlConverter.MaxNodeCount.set -> void

src/Microsoft.OpenApi.YamlReader/YamlConverter.cs

@@ -19,15 +19,58 @@ public static class YamlConverter
         /// Mirrors the default System.Text.Json depth limit (64) that already bounds the JSON reader path,
         /// protecting the recursive conversion from stack exhaustion on deeply nested documents.
         /// </summary>
-        internal const int DefaultMaxDepth = 64;
+        public const int DefaultMaxDepth = 64;
 
         /// <summary>
         /// Default maximum number of JSON nodes that may be materialized from a single YAML document.
         /// Guards against YAML anchor/alias expansion ("billion laughs") attacks, where a tiny document
         /// expands exponentially when its shared node graph is materialized into an independent JSON tree.
-        /// Increase this only if legitimate large documents are being rejected.
         /// </summary>
-        internal const int DefaultMaxNodeCount = 5_000_000;
+        public const int DefaultMaxNodeCount = 5_000_000;
+
+        private static int _maxDepth = DefaultMaxDepth;
+        private static int _maxNodeCount = DefaultMaxNodeCount;
+
+        /// <summary>
+        /// Gets or sets the maximum nesting depth allowed when converting a YAML node graph into JSON nodes.
+        /// Defaults to <see cref="DefaultMaxDepth"/>. Raise this if legitimate deeply nested documents are
+        /// being rejected, or lower it to fail faster when only shallow documents are expected.
+        /// </summary>
+        /// <exception cref="ArgumentOutOfRangeException">Thrown when set to a value less than 1.</exception>
+        public static int MaxDepth
+        {
+            get => _maxDepth;
+            set
+            {
+                if (value < 1)
+                {
+                    throw new ArgumentOutOfRangeException(nameof(value), "MaxDepth must be greater than zero.");
+                }
+
+                _maxDepth = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the maximum number of JSON nodes that may be materialized from a single YAML document.
+        /// Defaults to <see cref="DefaultMaxNodeCount"/>, guarding against YAML anchor/alias expansion
+        /// ("billion laughs") attacks. Raise this if legitimate large documents are being rejected, or lower
+        /// it to fail faster when only small documents are expected.
+        /// </summary>
+        /// <exception cref="ArgumentOutOfRangeException">Thrown when set to a value less than 1.</exception>
+        public static int MaxNodeCount
+        {
+            get => _maxNodeCount;
+            set
+            {
+                if (value < 1)
+                {
+                    throw new ArgumentOutOfRangeException(nameof(value), "MaxNodeCount must be greater than zero.");
+                }
+
+                _maxNodeCount = value;
+            }
+        }
 
         /// <summary>
         /// Tracks and enforces resource limits while converting a YAML node graph into JSON nodes,
@@ -39,7 +82,7 @@ private sealed class YamlConversionBudget
             private readonly int _maxNodeCount;
             private int _nodeCount;
 
-            public YamlConversionBudget(int maxDepth = DefaultMaxDepth, int maxNodeCount = DefaultMaxNodeCount)
+            public YamlConversionBudget(int maxDepth, int maxNodeCount)
             {
                 _maxDepth = maxDepth;
                 _maxNodeCount = maxNodeCount;
@@ -87,7 +130,7 @@ public static JsonNode ToJsonNode(this YamlDocument yaml)
         /// <exception cref="NotSupportedException">Thrown for YAML that is not compatible with JSON.</exception>
         public static JsonNode ToJsonNode(this YamlNode yaml)
         {
-            return yaml.ToJsonNode(new YamlConversionBudget(), 0);
+            return yaml.ToJsonNode(new YamlConversionBudget(MaxDepth, MaxNodeCount), 0);
         }
 
         private static JsonNode ToJsonNode(this YamlNode yaml, YamlConversionBudget budget, int depth)
@@ -130,7 +173,7 @@ public static YamlNode ToYamlNode(this JsonNode json)
         /// <returns></returns>
         public static JsonObject ToJsonObject(this YamlMappingNode yaml)
         {
-            return yaml.ToJsonObject(new YamlConversionBudget(), 0);
+            return yaml.ToJsonObject(new YamlConversionBudget(MaxDepth, MaxNodeCount), 0);
         }
 
         private static JsonObject ToJsonObject(this YamlMappingNode yaml, YamlConversionBudget budget, int depth)
@@ -160,7 +203,7 @@ private static YamlMappingNode ToYamlMapping(this JsonObject obj)
         /// <returns></returns>
         public static JsonArray ToJsonArray(this YamlSequenceNode yaml)
         {
-            return yaml.ToJsonArray(new YamlConversionBudget(), 0);
+            return yaml.ToJsonArray(new YamlConversionBudget(MaxDepth, MaxNodeCount), 0);
         }
 
         private static JsonArray ToJsonArray(this YamlSequenceNode yaml, YamlConversionBudget budget, int depth)

test/Microsoft.OpenApi.Readers.Tests/YamlConverterTests.cs

@@ -381,6 +381,55 @@ public void LegitimateAliasesStillConvert()
         Assert.Equal("hello", jsonNode["b"]?.GetValue<string>());
     }
 
+    [Fact]
+    public void ConversionLimitsDefaultToDocumentedValues()
+    {
+        Assert.Equal(64, YamlConverter.DefaultMaxDepth);
+        Assert.Equal(5_000_000, YamlConverter.DefaultMaxNodeCount);
+        Assert.Equal(YamlConverter.DefaultMaxDepth, YamlConverter.MaxDepth);
+        Assert.Equal(YamlConverter.DefaultMaxNodeCount, YamlConverter.MaxNodeCount);
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-1)]
+    public void SettingMaxDepthBelowOneThrows(int value)
+    {
+        Assert.Throws<ArgumentOutOfRangeException>(() => YamlConverter.MaxDepth = value);
+        // The invalid assignment must not have changed the effective limit.
+        Assert.Equal(YamlConverter.DefaultMaxDepth, YamlConverter.MaxDepth);
+    }
+
+    [Theory]
+    [InlineData(0)]
+    [InlineData(-1)]
+    public void SettingMaxNodeCountBelowOneThrows(int value)
+    {
+        Assert.Throws<ArgumentOutOfRangeException>(() => YamlConverter.MaxNodeCount = value);
+        // The invalid assignment must not have changed the effective limit.
+        Assert.Equal(YamlConverter.DefaultMaxNodeCount, YamlConverter.MaxNodeCount);
+    }
+
+    [Fact]
+    public void RaisingMaxDepthAllowsDocumentsDeeperThanTheDefault()
+    {
+        // A document nested deeper than the default depth limit (64) is rejected by default
+        // but can be permitted by a consumer that opts into a higher limit.
+        const int depth = 70;
+        var deeplyNested = new string('[', depth) + new string(']', depth);
+
+        try
+        {
+            YamlConverter.MaxDepth = depth + 10;
+            var jsonNode = ConvertYamlStringToJsonNode(deeplyNested);
+            Assert.IsType<JsonArray>(jsonNode);
+        }
+        finally
+        {
+            YamlConverter.MaxDepth = YamlConverter.DefaultMaxDepth;
+        }
+    }
+
     private static JsonNode ConvertYamlStringToJsonNode(string yamlInput)
     {
         var yamlDocument = new YamlStream();