fix(readers): bound YAML anchor/alias expansion, configurable via reader settings

[Copilot]

Pull Request

Description

Ports the billion-laughs guard from main (#3000) to the v1 reader. The v1 reader walks the SharpYaml node graph directly: aliases share a single source node, so a tiny document expands exponentially when materialized into independent IOpenApiAny trees, exhausting process memory (CWE-400). The v1 reader has a different shape from main's YamlConverter, so the fix is applied manually rather than cherry-picked, and the limits are exposed on OpenApiReaderSettings instead of a static type.

var reader = new OpenApiStringReader(new OpenApiReaderSettings
{
    MaxDepth = 128,          // default 64
    MaxNodeCount = 1_000_000 // default 5,000,000
});

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Other (please describe):

Changes Made

• OpenApiReaderSettings: new MaxDepth / MaxNodeCount properties with DefaultMaxDepth (64, mirroring System.Text.Json) and DefaultMaxNodeCount (5,000,000); zero is rejected.
• ParsingContext: per-parse node budget enforced in CountNode, called from the ParseNode constructor, failing with OpenApiReaderException.
• ParseNode and subclasses: CreateAny threads a depth counter and rejects graphs nested beyond the configured depth, protecting the recursive readers from stack exhaustion.
• OpenApiYamlDocumentReader: flows both limits from settings into every ParsingContext it creates.

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• All existing tests pass

New YamlAliasExpansionTests cover: a YAML bomb rejected during conversion and surfaced as a diagnostic error through OpenApiStringReader, excessive nesting rejected, legitimate aliases still resolving, default limit values, zero rejection, and a raised MaxDepth admitting a deeper document.

Checklist

• My code follows the code style of this project
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Versions applicability

• My change applies to the version 1.X of the library, if so PR link: this PR
• My change applies to the version 2.X of the library, if so PR link: fix: bound YAML anchor/alias expansion to prevent OOM (billion laughs) #3000
• My change applies to the version 3.X of the library, if so PR link:
• I have evaluated the applicability of my change against the other versions above.

See the contributing guidelines for more information about how patches are applied across multiple versions.

Additional Notes

Scope is 8 files in Microsoft.OpenApi.Readers plus one new test file. The branch content is support/v1 plus this patch; the PR base needs to be retargeted from main to support/v1 — the agent sandbox cannot set the base branch.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
86.4% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Vincent Biret (baywet)]

closed and re-open as #3020 for clean commit history