fix: decode tag URI escapes

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: MariusStorhaug

src/functions/private/ConvertFrom-YamlTagUriText.ps1

@@ -0,0 +1,44 @@
+function ConvertFrom-YamlTagUriText {
+    <#
+        .SYNOPSIS
+        Decodes percent-encoded UTF-8 octets in YAML tag URI text.
+    #>
+    [CmdletBinding()]
+    [OutputType([string])]
+    param (
+        [Parameter(Mandatory)]
+        [AllowEmptyString()]
+        [string] $Text
+    )
+
+    $builder = [System.Text.StringBuilder]::new($Text.Length)
+    $bytes = [System.Collections.Generic.List[byte]]::new()
+    $utf8 = [System.Text.UTF8Encoding]::new($false, $true)
+    $index = 0
+
+    while ($index -lt $Text.Length) {
+        if ($Text[$index] -ne '%') {
+            [void] $builder.Append($Text[$index])
+            $index++
+            continue
+        }
+
+        $bytes.Clear()
+        while ($index -lt $Text.Length -and $Text[$index] -eq '%') {
+            if ($index + 2 -ge $Text.Length -or
+                $Text[$index + 1] -notmatch '^[0-9A-Fa-f]$' -or
+                $Text[$index + 2] -notmatch '^[0-9A-Fa-f]$') {
+                throw [System.FormatException]::new(
+                    "The tag URI contains an incomplete or malformed percent escape at index $index."
+                )
+            }
+
+            $bytes.Add([System.Convert]::ToByte($Text.Substring($index + 1, 2), 16))
+            $index += 3
+        }
+
+        [void] $builder.Append($utf8.GetString($bytes.ToArray()))
+    }
+
+    $builder.ToString()
+}

src/functions/private/Resolve-YamlTag.ps1

@@ -67,7 +67,19 @@ function Resolve-YamlTag {
         }
     }
 
-    $expandedLength = $prefix.Length + $suffix.Length
+    try {
+        $expanded = ConvertFrom-YamlTagUriText -Text ($prefix + $suffix)
+    } catch [System.FormatException] {
+        throw (New-YamlException -Start $Mark -End $Mark -ErrorId 'YamlInvalidTag' -Message (
+                "The tag token '$Token' contains a malformed URI escape."
+            ))
+    } catch [System.Text.DecoderFallbackException] {
+        throw (New-YamlException -Start $Mark -End $Mark -ErrorId 'YamlInvalidTag' -Message (
+                "The tag token '$Token' contains URI escapes that are not valid UTF-8."
+            ))
+    }
+
+    $expandedLength = $expanded.Length
     if ($expandedLength -gt $Context.MaxTagLength) {
         throw (New-YamlException -Start $Mark -End $Mark -ErrorId 'YamlTagLimitExceeded' -Message (
                 "A YAML tag exceeds the configured limit of $($Context.MaxTagLength) characters."
@@ -80,7 +92,6 @@ function Resolve-YamlTag {
             ))
     }
 
-    $expanded = $prefix + $suffix
     $known = $expanded -cin @(
         'tag:yaml.org,2002:binary',
         'tag:yaml.org,2002:bool',

tests/Conformance.Tests.ps1

@@ -48,18 +48,12 @@ Describe 'Released yaml-test-suite corpus accounting' {
     }
 
     It 'accounts for parser representation/event comparisons' {
-        @($suiteResults | Where-Object EventResult -EQ 'Pass').Count | Should -Be 307
+        @($suiteResults | Where-Object EventResult -EQ 'Pass').Count | Should -Be 308
         @($suiteResults | Where-Object EventResult -EQ 'PolicyDifference').Count |
-            Should -Be 1
+            Should -Be 0
         @($suiteResults | Where-Object EventResult -EQ 'Fail').Count | Should -Be 0
         @($suiteResults | Where-Object EventResult -EQ 'NotApplicable').Count |
             Should -Be 94
-        @(
-            $suiteResults |
-                Where-Object EventResult -EQ 'PolicyDifference' |
-                Select-Object -ExpandProperty Case |
-                Sort-Object
-        ) | Should -Be @('6CK3')
     }
 
     It 'accounts for JSON construction comparisons' {

tests/ConvertFrom-Yaml.Tests.ps1

@@ -187,6 +187,37 @@ mapping: !<tag:example.test,2026:object>
             $result.mapping.name | Should -Be 'safe'
         }
 
+        It 'decodes percent escapes in expanded representation tags' {
+            $escaped = Get-TestYamlRepresentationRoot -Yaml (
+                "%TAG !e! tag:example.com,2000:app/`n--- !e!tag%21 value"
+            )
+            $multibyte = Get-TestYamlRepresentationRoot -Yaml (
+                "%TAG !e! tag:example.com,2000:app/`n--- !e!caf%C3%A9 value"
+            )
+
+            $escaped.Tag | Should -Be 'tag:example.com,2000:app/tag!'
+            $escaped.HasUnknownTag | Should -BeTrue
+            $multibyte.Tag | Should -Be (
+                'tag:example.com,2000:app/caf{0}' -f [char] 0x00E9
+            )
+            $multibyte.HasUnknownTag | Should -BeTrue
+        }
+
+        It 'retains unknown local and global tags before neutral value projection' {
+            $local = Get-TestYamlRepresentationRoot -Yaml '!local value'
+            $global = Get-TestYamlRepresentationRoot -Yaml (
+                '!<tag:example.test,2026:object> value'
+            )
+
+            $local.Tag | Should -Be '!local'
+            $local.HasUnknownTag | Should -BeTrue
+            $global.Tag | Should -Be 'tag:example.test,2026:object'
+            $global.HasUnknownTag | Should -BeTrue
+            ('!local value' | ConvertFrom-Yaml) | Should -Be 'value'
+            ('!<tag:example.test,2026:object> value' | ConvertFrom-Yaml) |
+                Should -Be 'value'
+        }
+
         It 'preserves repeated collection references' {
             $result = @'
 source: &source

tests/Test-Yaml.Tests.ps1

@@ -48,6 +48,17 @@ Describe 'Test-Yaml' {
         ("a: &a value`nb: &b *a" | Test-Yaml) | Should -BeFalse
     }
 
+    It 'rejects malformed or invalid UTF-8 tag URI escapes: <Tag>' -ForEach @(
+        @{ Tag = '!value%' }
+        @{ Tag = '!value%2' }
+        @{ Tag = '!value%GG' }
+        @{ Tag = '!value%C3' }
+        @{ Tag = '!value%C3%28' }
+    ) {
+        ("$Tag value" | Test-Yaml) | Should -BeFalse
+        { "$Tag value" | ConvertFrom-Yaml } | Should -Throw
+    }
+
     It 'recognizes document markers only at column zero' {
         ("key:`n  ---" | Test-Yaml) | Should -BeTrue
         ("key:`n  ..." | Test-Yaml) | Should -BeTrue

tests/TestBootstrap.ps1

@@ -51,6 +51,7 @@ function Get-TestYamlFingerprintLength {
         } finally {
             $hasher.Dispose()
         }
+
         @($cache.Values | ForEach-Object Length)
     }
 
@@ -60,3 +61,34 @@ function Get-TestYamlFingerprintLength {
     }
     return @(& $loadedModule $implementation $Yaml)
 }
+
+function Get-TestYamlRepresentationRoot {
+    <#
+        .SYNOPSIS
+        Returns observable metadata from the root representation node.
+    #>
+    param (
+        [Parameter(Mandatory)]
+        [string] $Yaml
+    )
+
+    $implementation = {
+        param ([string] $YamlText)
+
+        $document = (Read-YamlStreamCore -Yaml $YamlText -Depth 100 -MaxNodes 100 -MaxAliases 100 `
+                -MaxScalarLength 1048576 -MaxTagLength 1024 -MaxTotalTagLength 65536 `
+                -MaxNumericLength 4096).Value[0]
+        [pscustomobject]@{
+            Kind          = $document.Kind
+            Tag           = $document.Tag
+            HasUnknownTag = $document.HasUnknownTag
+            Value         = $document.Value
+        }
+    }
+
+    $loadedModule = Get-Module -Name Yaml | Select-Object -First 1
+    if ($null -eq $loadedModule) {
+        return & $implementation $Yaml
+    }
+    return & $loadedModule $implementation $Yaml
+}

tests/tools/Invoke-YamlTestSuite.ps1

@@ -259,10 +259,6 @@ function Get-YamlSuitePolicyReason {
     if ($YamlText -cmatch '!!(?:binary|omap|pairs|set|timestamp)(?:[ \t\r\n,\[\]\{\}]|$)') {
         return 'StandardTagProjectionPolicy'
     }
-    if ($YamlText -cmatch '(?:^|[ \t\r\n\[\]\{\},])!<(?!tag:yaml\.org,2002:)' -or
-        $YamlText -cmatch '(?:^|[ \t\r\n\[\]\{\},])![^\s!<][^\s:,\]\}\{]*') {
-        return 'UnknownTagProjectionPolicy'
-    }
     if (($Expected -match 'unsupported:' -or $Actual -match 'unsupported:')) {
         return 'PowerShellTypePolicy'
     }