Polymorphic serialization hangs

[ukarlsson]

Hello. Many thanks for this great library. We ran into an issue that is quite strange. The deserialization hangs in this specific case, meaning that the process does not terminate, but uses 100% CPU.

import com.charleskorn.kaml.Yaml
import kotlinx.serialization.SerialName
import kotlinx.serialization.Serializable
import kotlinx.serialization.builtins.ListSerializer

@Serializable
private sealed class K {
    @Serializable
    @SerialName("x")
    data class X(
        val property: List<String>? = null,
    ) : K()
}

const val s = """
- !<x>
"""

fun main() {
    Yaml.default.decodeFromString(ListSerializer(K.serializer()), s)
}

This is what I see when I pause and enter debugger

[charleskorn]

Thanks for the bug report @ukarlsson. Are you able to share a sample project that triggers this issue?

If not, could you please share what version of kaml, Kotlin and kotlinx.serialization you're using?

[ukarlsson]

Latest versions that I could find. I attached project

kaml-bug.tar.gz

[charleskorn]

Thanks for the sample project.

I've been able to reproduce the issue, and slightly simplify the scenario that triggers it:

import com.charleskorn.kaml.Yaml
import kotlinx.serialization.SerialName
import kotlinx.serialization.Serializable

@Serializable
private sealed class K {
    @Serializable
    @SerialName("x")
    data class X(
        val property: String? = null,
    ) : K()
}

const val s = """
!<x>
"""

fun main() {
    println("Started.")
    val result = Yaml.default.decodeFromString(K.serializer(), s)
    println("Finished, result is $result")
}

The hang doesn't happen when PolymorphismStyle.Property is used - it only affects tagged polymorphism.

[charleskorn]

Thanks again for reporting this issue @ukarlsson. I've fixed it and 0.35.3 includes the fix.

Note that this may be a vulnerability depending on how your application uses kaml - please see the security advisory for more information.

[ukarlsson]

Many thanks for fixing quickly!