parser: avoid reparsing flow sequence pair keys

When a flow sequence item is detected as a key/value pair, wrap the
already parsed key events in a synthetic flow mapping event instead of
rewinding and parsing the key again.

Nested flow sequence pairs could otherwise trigger exponential parsing
time before construction rejected the resulting complex object key.

Author: puzrin

src/parser/parser.ts

@@ -148,6 +148,18 @@ function addMappingEvent (
   })
 }
 
+function insertFlowPairMappingEvent (state: ParserState, snapshot: ParserSnapshot) {
+  state.events.splice(snapshot.eventsLength, 0, {
+    type: EVENT_MAPPING,
+    start: snapshot.position,
+    anchorStart: NO_RANGE,
+    anchorEnd: NO_RANGE,
+    tagStart: NO_RANGE,
+    tagEnd: NO_RANGE,
+    style: COLLECTION_STYLE_FLOW
+  })
+}
+
 function addScalarEvent (
   state: ParserState,
   valueStart: number,
@@ -911,14 +923,8 @@ function readFlowCollection (state: ParserState, nodeIndent: number, props: Node
       state.position++
       skipFlowSeparationSpace(state, nodeIndent)
       if (!isMapping) {
-        restoreState(state, entryStart)
-        addMappingEvent(state, entryStart.position, NO_RANGE, NO_RANGE, NO_RANGE, NO_RANGE, COLLECTION_STYLE_FLOW)
-        if (!parseNode(state, nodeIndent, CONTEXT_FLOW_IN, false, true)) {
-          addEmptyScalarEvent(state)
-        }
-        skipFlowSeparationSpace(state, nodeIndent)
-        state.position++
-        skipFlowSeparationSpace(state, nodeIndent)
+        insertFlowPairMappingEvent(state, entryStart)
+        if (!keyWasRead) addEmptyScalarEvent(state)
       } else if (!keyWasRead) {
         addEmptyScalarEvent(state)
       }
@@ -933,9 +939,8 @@ function readFlowCollection (state: ParserState, nodeIndent: number, props: Node
     } else if (isMapping) {
       addEmptyScalarEvent(state)
     } else if (isPair) {
-      restoreState(state, entryStart)
-      addMappingEvent(state, entryStart.position, NO_RANGE, NO_RANGE, NO_RANGE, NO_RANGE, COLLECTION_STYLE_FLOW)
-      parseNode(state, nodeIndent, CONTEXT_FLOW_IN, false, true)
+      insertFlowPairMappingEvent(state, entryStart)
+      if (!keyWasRead) addEmptyScalarEvent(state)
       addEmptyScalarEvent(state)
       addPopEvent(state)
     }

test/core/pathological.test.mjs

@@ -41,6 +41,14 @@ describe('Pathological tests', () => {
     })
   })
 
+  describe('Flow collection pairs', () => {
+    it('throws YAMLException on nested flow pairs without reparsing keys exponentially', () => {
+      assertYamlException(() => {
+        load('[ '.repeat(40) + '1' + ' ]: 0'.repeat(40))
+      }, /object-based map does not support complex keys/)
+    })
+  })
+
   describe('Merge aliases', () => {
     it('throws YAMLException when merge chain exceeds maxTotalMergeKeys', () => {
       assertYamlException(() => {