fix(security): bound YAML alias expansion in file-parser (billion-laughs DoS)

[waleedlatif1]

Summary

The YAML file parser (`apps/sim/lib/file-parsers/yaml-parser.ts`) called `yaml.load()` then `JSON.stringify()` on the result. YAML aliases (`*anchor`) resolve to shared references, so `yaml.load` cheaply builds a compact in-memory DAG — but `JSON.stringify` does not preserve sharing and expands that DAG into a full tree, duplicating every shared node. A crafted sub-1 KB `.yaml`/`.yml` document therefore expands to hundreds of MB / GB during serialization, pinning CPU and forcing enormous transient allocations that OOM-kill or wedge the worker (CWE-776).

The existing 100 MB download / file-size caps don't help — the amplification happens after the size check, at `JSON.stringify` time.

Reachability

• Workflow File parse block → `POST /api/files/parse` → `parseYAMLBuffer`.
• Knowledge-base ingestion → `document-processor.ts` → `parseDocument` → YAML parser, running on a shared background worker serving other tenants. One tiny upload can OOM-kill the worker (co-tenant DoS).

Fix

Add a bounded, iterative traversal (`assertYamlWithinLimits`) that runs on the compact DAG before `JSON.stringify`, aborting once any of these caps is exceeded:

• Expanded node count (5,000,000) — repeated aliased references are counted each time they're reached, mirroring how `JSON.stringify` expands them, so the bomb is detected against the small DAG. Also terminates cyclic anchor structures.
• Estimated serialized size (64 MB) — accounts for the pretty-print indentation overhead that dominates deep alias bombs, so amplification is rejected before the bytes are ever allocated.
• Nesting depth (500) — defense-in-depth (js-yaml itself already caps load depth at 100).

This also replaces the unbounded recursive `getYamlDepth` — which spread large arrays into `Math.max(...array)` (stack-overflow risk) — with the same single bounded walk that computes depth for metadata.

On breach a distinct `YamlComplexityError` is thrown (kept separate from the generic `Invalid YAML` syntax error so a resource-exhaustion attempt is distinguishable from a malformed file).

Tests

New `yaml-parser.test.ts`:

• normal document + array metadata/depth still parse correctly
• a <2 KB chained alias bomb is rejected as `YamlComplexityError` (whole suite runs in ~20 ms — proof the guard fires before any serialization)
• malformed YAML still surfaces as `Invalid YAML`
• direct guard coverage: depth-cap breach and cyclic structure both rejected via the node cap

All 7 tests pass; typecheck and biome clean.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 18, 2026 7:04pm

[cursor]

PR Summary

Medium Risk
Security-critical file ingestion path with new rejection behavior for oversized YAML; legitimate very large YAML near caps could be rejected, but normal documents are covered by tests.

Overview
Hardens YAML parsing against alias-expansion (“billion laughs”) DoS by validating the parsed document before JSON.stringify, since tiny inputs can explode when aliases are expanded at serialize time.

The YAML parser now runs assertYamlWithinLimits, an iterative walk that mirrors alias duplication with caps on expanded node count (5M), estimated pretty-printed JSON size (64 MB, including key and escape-aware string charging), and nesting depth (500). Breaches raise YamlComplexityError (distinct from syntax errors). The old unbounded recursive depth helper is removed in favor of this same bounded traversal.

POST /api/files/parse no longer falls back to returning the upload as raw UTF-8 when the YAML parser rejects a document for complexity—those errors propagate instead of bypassing the guard.

Adds yaml-parser.test.ts covering normal parses, alias/key bombs, malformed YAML, and direct limit behavior.

^{Reviewed by Cursor Bugbot for commit 5c5d8aa. Configure here.}

[greptile-apps]

Greptile Summary

This PR limits YAML alias expansion before parsed documents are serialized. The main changes are:

• Adds node-count, serialized-size, and nesting-depth limits.
• Accounts for object keys, JSON escaping, and lone surrogates in size estimates.
• Preserves complexity errors instead of treating them as ordinary syntax failures.
• Adds tests for normal documents and several YAML expansion attacks.

Confidence Score: 5/5

This looks safe to merge.

• The updated estimate includes repeated object keys and escaped string output.
• Complexity limits run before JSON serialization.
• Complexity errors remain distinct across the updated parser path.
• No blocking issue was found in the changed code.

Important Files Changed

Filename	Overview
apps/sim/lib/file-parsers/yaml-parser.ts	Adds bounded traversal and detailed serialized-size accounting before YAML serialization.
apps/sim/lib/file-parsers/yaml-parser.test.ts	Covers normal parsing, alias expansion, key amplification, escaping, cycles, and depth limits.
apps/sim/app/api/files/parse/route.ts	Keeps YAML complexity rejections from falling back to generic parsing.

_{Reviews (3): Last reviewed commit: "yaml guard: charge lone surrogates at th..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 5c5d8aa. Configure here.}