DoS by parsing deeply nested YAML

[dtolnay]

// [dependencies]
// serde = "1"
// serde_yaml_ng = "0.10"

fn main() {
    const N: usize = 8000;
    let y = r#"{"":["#.repeat(N) + &r"]}".repeat(N);
    let begin = std::time::Instant::now();
    let serde::de::IgnoredAny = serde_yaml_ng::from_str(&y).unwrap();
    println!("{:?}", begin.elapsed());
}

At N=8k, cargo run --release takes about 1 second. At N=16k, about 4 seconds. At N=32k, 16 seconds. Each doubling of input size quadruples the runtime. This is O(n²) scaling, which is risky for many use cases because relatively small amounts of untrusted input can tie up enormous amount of CPU time.

[acatton]

That's a fair point. I think this is blocking 1.0.

I would like to address that once I've fixed #5, as I think we'll have a clearer view on where is the responsibility.