{"record":{"id":"a2cf26cae85e151f","repo":"apple/pkl","slug":"yamlparseerrortoomanyaliases","errorCode":"yamlParseErrorTooManyAliases","errorMessage":"yamlParseErrorTooManyAliases","messagePattern":"yamlParseErrorTooManyAliases","errorType":"error_code","errorClass":"VmException","httpStatus":null,"severity":"error","filePath":"pkl-core/src/main/java/org/pkl/core/stdlib/yaml/ParserNodes.java","lineNumber":77,"sourceCode":"    @TruffleBoundary\n    protected Object eval(\n        VmTyped self, VmTyped resource, @Cached(\"create()\") IndirectCallNode callNode) {\n      var text = (String) VmUtils.readMember(resource, Identifier.TEXT, callNode);\n      var uri = (String) VmUtils.readMember(resource, Identifier.URI, callNode);\n      return doParse(self, text, uri);\n    }\n\n    private Object doParse(VmTyped self, String text, String uri) {\n      var converter = PklConverter.fromParser(self);\n      var load = createLoad(self, text, uri, converter);\n\n      try {\n        var document = load.loadFromString(text);\n        return converter.convert(document, List.of());\n      } catch (YamlEngineException e) {\n        if (e.getMessage()\n            .startsWith(\"Number of aliases for non-scalar nodes exceeds the specified\")) {\n          throw exceptionBuilder()\n              .evalError(\"yamlParseErrorTooManyAliases\", getMaxCollectionAliases(self))\n              .build();\n        }\n        throw exceptionBuilder().evalError(\"yamlParseError\").withHint(e.getMessage()).build();\n      }\n    }\n  }\n\n  public abstract static class parseAll extends ExternalMethod1Node {\n    @Specialization\n    @TruffleBoundary\n    protected VmList eval(VmTyped self, String text) {\n      var uri = \"input_string\";\n      return doParseAll(self, text, uri);\n    }\n\n    @Specialization\n    @TruffleBoundary","sourceCodeStart":59,"sourceCodeEnd":95,"githubUrl":"https://github.com/apple/pkl/blob/f3efcbfc9b60d30053b0536d664948d7aa1b8673/pkl-core/src/main/java/org/pkl/core/stdlib/yaml/ParserNodes.java#L59-L95","documentation":"`yaml.parse` throws `yamlParseErrorTooManyAliases` when the SnakeYAML engine rejects the document because the number of aliases for non-scalar nodes exceeds the configured limit (`maxCollectionAliases`, default 50). This limit exists to prevent YAML 'billion laughs'/alias-expansion denial-of-service attacks. The configured max is included as an error parameter.","triggerScenarios":"Calling `yaml.parse(text)` on a YAML document containing more alias references to non-scalar (collection) anchors than the limit set via `maxCollectionAliases` on the receiver; raised in ParserNodes.doParse when the YamlEngineException message starts with 'Number of aliases for non-scalar nodes exceeds the specified'.","commonSituations":"Parsing machine-generated or deeply self-referential YAML (e.g. Kubernetes manifests, serialized object dumps) with many repeated anchors/aliases; documents exported from YAML libraries that aggressively share structures.","solutions":["Raise the limit by setting `maxCollectionAliases` on the yaml receiver before parsing","De-duplicate the document: replace repeated aliased blocks with literal values (e.g. via yq or a preprocessor)","Reduce anchor/alias usage in the source YAML, inlining the referenced nodes","If the aliases are only scalar anchors, keep them — the limit only counts non-scalar (map/list) aliases"],"exampleFix":"// before\nyaml.maxCollectionAliases = 50\nresult = yaml.parse(text)\n// after\nyaml.maxCollectionAliases = 1000\nresult = yaml.parse(text)","handlingStrategy":"validation","validationCode":"// rough pre-check: count anchor definitions and alias uses\naliasCount = text.split(\"*\").length - 1\nassert(aliasCount <= yaml.maxCollectionAliases)","typeGuard":null,"tryCatchPattern":"try {\n  doc = yaml.parse(text)\n} catch (e) {\n  if (e.message.contains(\"aliases\")) {\n    yaml.maxCollectionAliases = 10000\n    doc = yaml.parse(text)\n  } else throw e\n}","preventionTips":["Keep maxCollectionAliases configured for known-alias-heavy sources","Preprocess third-party YAML to expand aliases before parsing","Treat excessive aliases as a security signal — validate document provenance"],"tags":["yaml","pkl","stdlib","security-limit"],"backgroundTag":"yaml-parse-error","analyzedSha":"f3efcbfc9b60d30053b0536d664948d7aa1b8673","analyzedAt":"2026-09-08T13:10:45.570Z","contentChangedAt":"2026-09-08T13:10:45.570Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}