JsonParseException when YAML mapping key is a sequence

[af851574-oss]

JsonParseException when YAML mapping key is a sequence

Description

I am trying to parse a YAML document using Jackson’s YAMLMapper (jackson-dataformat-yaml) in Kotlin/Java, but parsing fails when a mapping key is a sequence. The exception occurs before any schema validation, indicating that YamlMapper cannot handle this case.

YAML Example

? [user, 123]
: name: Иван
  age: 30

Kotlin Example

import com.fasterxml.jackson.dataformat.yaml.YAMLMapper

fun main() {
    val yaml = """
? [user, 123]
: name: Иван
  age: 30
""".trimIndent()

    val mapper = YAMLMapper()
    val node = mapper.readTree(yaml) // Exception occurs here
}

Exception

com.fasterxml.jackson.core.JsonParseException: 
Expected a field name (Scalar value in YAML), got this instead: 
<org.yaml.snakeyaml.events.SequenceStartEvent(anchor=null, tag=null, implicit=true)>

Environment

• jackson-dataformat-yaml version: 2.15.x
• Kotlin/Java 17
• OS: macOS / Linux

Notes / Expected Behavior

• According to the YAML spec, using a sequence as a mapping key is valid.
• Jackson fails because JsonNode only supports scalar keys.
• Ideally, Jackson should either parse the key into a string representation or provide a clear API to handle non-scalar mapping keys.

References

• YAML spec: https://yaml.org/spec/1.2/spec.html#id2760799
• Jackson YAMLMapper / YAMLFactory

Request

• Support for sequence (and possibly other complex structures) as mapping keys, or
• Better documentation / error message when sequence is used as a key.

[asomov]

@af851574-oss this is not a simple case. Indeed, YAML is very flexible in the way how the keys may be defined. Unfortunately, it leads to a number of cases when a hacker may provide a very sophisticated YAML document which may consume many CPU resources and SnakeYAML has a zillion of fake false positives because of that. That is why in the latest SnakeYAML version by default the keys must be scalars.
Since Jackson is not using the latest version (I hope it will happen soon), this issue is not directly related but it is somehow connected.
By the way, I hope nothing stops you from using SnakeYAML directly, where you are free to define anything as mapping keys. Jackson is very generic and your use case may be very limited to serve the general purpose.