refactor(readers): move YAML expansion limits into OpenApiReaderSettings

Co-authored-by: baywet <7905502+baywet@users.noreply.github.com>

Author: Copilot

src/Microsoft.OpenApi.Readers/OpenApiReaderLimits.cs

@@ -36,6 +36,64 @@ public enum ReferenceResolutionSetting
     /// </summary>
     public class OpenApiReaderSettings
     {
+        /// <summary>
+        /// Default maximum nesting depth allowed when materializing values from a YAML/JSON node graph.
+        /// Mirrors the default System.Text.Json depth limit (64), protecting the recursive readers
+        /// from stack exhaustion on deeply nested documents.
+        /// </summary>
+        public const uint DefaultMaxDepth = 64;
+
+        /// <summary>
+        /// Default maximum number of nodes that may be materialized from a single document.
+        /// Guards against YAML anchor/alias expansion ("billion laughs") attacks, where a tiny document
+        /// expands exponentially when its shared node graph is materialized into an independent tree.
+        /// </summary>
+        public const uint DefaultMaxNodeCount = 5_000_000;
+
+        private uint _maxDepth = DefaultMaxDepth;
+        private uint _maxNodeCount = DefaultMaxNodeCount;
+
+        /// <summary>
+        /// Gets or sets the maximum nesting depth allowed when materializing values from a node graph.
+        /// Defaults to <see cref="DefaultMaxDepth"/>. Raise this if legitimate deeply nested documents are
+        /// being rejected, or lower it to fail faster when only shallow documents are expected.
+        /// </summary>
+        /// <exception cref="ArgumentOutOfRangeException">Thrown when set to zero.</exception>
+        public uint MaxDepth
+        {
+            get => _maxDepth;
+            set
+            {
+                if (value == 0)
+                {
+                    throw new ArgumentOutOfRangeException(nameof(value), "MaxDepth must be greater than zero.");
+                }
+
+                _maxDepth = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the maximum number of nodes that may be materialized from a single document.
+        /// Defaults to <see cref="DefaultMaxNodeCount"/>, guarding against YAML anchor/alias expansion
+        /// ("billion laughs") attacks. Raise this if legitimate large documents are being rejected, or lower
+        /// it to fail faster when only small documents are expected.
+        /// </summary>
+        /// <exception cref="ArgumentOutOfRangeException">Thrown when set to zero.</exception>
+        public uint MaxNodeCount
+        {
+            get => _maxNodeCount;
+            set
+            {
+                if (value == 0)
+                {
+                    throw new ArgumentOutOfRangeException(nameof(value), "MaxNodeCount must be greater than zero.");
+                }
+
+                _maxNodeCount = value;
+            }
+        }
+
         /// <summary>
         /// Indicates how references in the source document should be handled.
         /// </summary>

src/Microsoft.OpenApi.Readers/OpenApiReaderSettings.cs

@@ -47,7 +47,9 @@ public OpenApiDocument Read(YamlDocument input, out OpenApiDiagnostic diagnostic
             {
                 ExtensionParsers = _settings.ExtensionParsers,
                 BaseUrl = _settings.BaseUrl,
-                DefaultContentType = _settings.DefaultContentType
+                DefaultContentType = _settings.DefaultContentType,
+                MaxDepth = _settings.MaxDepth,
+                MaxNodeCount = _settings.MaxNodeCount
             };
 
             OpenApiDocument document = null;
@@ -91,7 +93,9 @@ public async Task<ReadResult> ReadAsync(YamlDocument input, CancellationToken ca
             var context = new ParsingContext(diagnostic)
             {
                 ExtensionParsers = _settings.ExtensionParsers,
-                BaseUrl = _settings.BaseUrl
+                BaseUrl = _settings.BaseUrl,
+                MaxDepth = _settings.MaxDepth,
+                MaxNodeCount = _settings.MaxNodeCount
             };
 
             OpenApiDocument document = null;
@@ -184,7 +188,9 @@ public T ReadFragment<T>(YamlDocument input, OpenApiSpecVersion version, out Ope
             diagnostic = new();
             var context = new ParsingContext(diagnostic)
             {
-                ExtensionParsers = _settings.ExtensionParsers
+                ExtensionParsers = _settings.ExtensionParsers,
+                MaxDepth = _settings.MaxDepth,
+                MaxNodeCount = _settings.MaxNodeCount
             };
 
             IOpenApiElement element = null;

src/Microsoft.OpenApi.Readers/OpenApiYamlDocumentReader.cs

@@ -82,7 +82,7 @@ public IOpenApiAny CreateAny()
         /// <summary>
         /// Materializes the node, and everything below it, into an <see cref="IOpenApiAny"/>.
         /// </summary>
-        /// <param name="depth">Nesting depth of the current node, bounded by <see cref="OpenApiReaderLimits.MaxDepth"/>.</param>
+        /// <param name="depth">Nesting depth of the current node, bounded by <see cref="OpenApiReaderSettings.MaxDepth"/>.</param>
         internal virtual IOpenApiAny CreateAny(uint depth)
         {
             throw new OpenApiReaderException("Cannot create an Any object this type of node.", Context);
@@ -94,9 +94,10 @@ internal virtual IOpenApiAny CreateAny(uint depth)
         /// </summary>
         protected void EnsureDepthWithinLimit(uint depth)
         {
-            if (depth > OpenApiReaderLimits.MaxDepth)
+            var maxDepth = Context?.MaxDepth ?? OpenApiReaderSettings.DefaultMaxDepth;
+            if (depth > maxDepth)
             {
-                throw new OpenApiReaderException($"The document exceeds the maximum supported nesting depth of {OpenApiReaderLimits.MaxDepth}.", Context);
+                throw new OpenApiReaderException($"The document exceeds the maximum supported nesting depth of {maxDepth}.", Context);
             }
         }
 

src/Microsoft.OpenApi.Readers/ParseNodes/ParseNode.cs

@@ -26,6 +26,8 @@ public class ParsingContext
         private readonly Dictionary<object, Dictionary<string, object>> _scopedTempStorage = new();
         private readonly Dictionary<string, Stack<string>> _loopStacks = new();
         private uint _nodeCount;
+        internal uint MaxDepth { get; set; } = OpenApiReaderSettings.DefaultMaxDepth;
+        internal uint MaxNodeCount { get; set; } = OpenApiReaderSettings.DefaultMaxNodeCount;
         internal Dictionary<string, Func<IOpenApiAny, OpenApiSpecVersion, IOpenApiExtension>> ExtensionParsers { get; set; } = new();
         internal RootNode RootNode { get; set; }
         internal List<OpenApiTag> Tags { get; private set; } = new();
@@ -201,15 +203,15 @@ public void StartObject(string objectName)
 
         /// <summary>
         /// Counts a node materialized while parsing the current document and fails fast when the
-        /// document expands beyond <see cref="OpenApiReaderLimits.MaxNodeCount"/>. YAML anchors and
+        /// document expands beyond <see cref="OpenApiReaderSettings.MaxNodeCount"/>. YAML anchors and
         /// aliases share a single node in the source graph, so a tiny document can expand
         /// exponentially ("billion laughs") when it is materialized into an independent tree.
         /// </summary>
         internal void CountNode()
         {
-            if (++_nodeCount > OpenApiReaderLimits.MaxNodeCount)
+            if (++_nodeCount > MaxNodeCount)
             {
-                throw new OpenApiReaderException($"The document expands to more than the maximum supported number of nodes ({OpenApiReaderLimits.MaxNodeCount}). This may indicate a YAML anchor/alias expansion (billion laughs) attack.");
+                throw new OpenApiReaderException($"The document expands to more than the maximum supported number of nodes ({MaxNodeCount}). This may indicate a YAML anchor/alias expansion (billion laughs) attack.");
             }
         }
 

src/Microsoft.OpenApi.Readers/ParsingContext.cs

@@ -1,4 +1,4 @@
-// Copyright (c) Microsoft Corporation. All rights reserved.
+// Copyright (c) Microsoft Corporation. All rights reserved.
 // Licensed under the MIT license.
 
 using System;
@@ -92,26 +92,32 @@ public void LegitimateAliasesStillConvert()
         [Fact]
         public void ConversionLimitsDefaultToDocumentedValues()
         {
-            Assert.Equal(64u, OpenApiReaderLimits.DefaultMaxDepth);
-            Assert.Equal(5_000_000u, OpenApiReaderLimits.DefaultMaxNodeCount);
-            Assert.Equal(OpenApiReaderLimits.DefaultMaxDepth, OpenApiReaderLimits.MaxDepth);
-            Assert.Equal(OpenApiReaderLimits.DefaultMaxNodeCount, OpenApiReaderLimits.MaxNodeCount);
+            var settings = new OpenApiReaderSettings();
+
+            Assert.Equal(64u, OpenApiReaderSettings.DefaultMaxDepth);
+            Assert.Equal(5_000_000u, OpenApiReaderSettings.DefaultMaxNodeCount);
+            Assert.Equal(OpenApiReaderSettings.DefaultMaxDepth, settings.MaxDepth);
+            Assert.Equal(OpenApiReaderSettings.DefaultMaxNodeCount, settings.MaxNodeCount);
         }
 
         [Fact]
         public void SettingMaxDepthToZeroThrows()
         {
-            Assert.Throws<ArgumentOutOfRangeException>(() => OpenApiReaderLimits.MaxDepth = 0);
+            var settings = new OpenApiReaderSettings();
+
+            Assert.Throws<ArgumentOutOfRangeException>(() => settings.MaxDepth = 0);
             // The invalid assignment must not have changed the effective limit.
-            Assert.Equal(OpenApiReaderLimits.DefaultMaxDepth, OpenApiReaderLimits.MaxDepth);
+            Assert.Equal(OpenApiReaderSettings.DefaultMaxDepth, settings.MaxDepth);
         }
 
         [Fact]
         public void SettingMaxNodeCountToZeroThrows()
         {
-            Assert.Throws<ArgumentOutOfRangeException>(() => OpenApiReaderLimits.MaxNodeCount = 0);
+            var settings = new OpenApiReaderSettings();
+
+            Assert.Throws<ArgumentOutOfRangeException>(() => settings.MaxNodeCount = 0);
             // The invalid assignment must not have changed the effective limit.
-            Assert.Equal(OpenApiReaderLimits.DefaultMaxNodeCount, OpenApiReaderLimits.MaxNodeCount);
+            Assert.Equal(OpenApiReaderSettings.DefaultMaxNodeCount, settings.MaxNodeCount);
         }
 
         [Fact]
@@ -122,16 +128,10 @@ public void RaisingMaxDepthAllowsDocumentsDeeperThanTheDefault()
             const int depth = 70;
             var deeplyNested = new string('[', depth) + new string(']', depth);
 
-            try
-            {
-                OpenApiReaderLimits.MaxDepth = (uint)(depth + 10);
-                var node = ParseNode.Create(new(new()), YamlHelper.ParseYamlString(deeplyNested));
-                Assert.IsType<OpenApiArray>(node.CreateAny());
-            }
-            finally
-            {
-                OpenApiReaderLimits.MaxDepth = OpenApiReaderLimits.DefaultMaxDepth;
-            }
+            var context = new ParsingContext(new()) { MaxDepth = depth + 10 };
+            var node = ParseNode.Create(context, YamlHelper.ParseYamlString(deeplyNested));
+
+            Assert.IsType<OpenApiArray>(node.CreateAny());
         }
 
         private static string YamlBombIndented()