fix: prevent infinite loops in collection deserialization by skipping unexpected tokens (#5)

Author: glucaci

src/Yamlify.SourceGenerator/YamlSourceGenerator.cs

@@ -566,6 +566,8 @@ private static void GenerateReadMethod(StringBuilder sb, TypeToGenerate type, IR
 
         sb.AppendLine("            if (reader.TokenType != YamlTokenType.MappingStart)");
         sb.AppendLine("            {");
+        sb.AppendLine("                // Skip unexpected token to prevent infinite loops when reading collections");
+        sb.AppendLine("                reader.Skip();");
         sb.AppendLine("                return default;");
         sb.AppendLine("            }");
         sb.AppendLine();
@@ -2819,6 +2821,8 @@ private static void GenerateRootCollectionRead(StringBuilder sb, ITypeSymbol col
 
         sb.AppendLine("            if (reader.TokenType != YamlTokenType.SequenceStart)");
         sb.AppendLine("            {");
+        sb.AppendLine("                // Skip unexpected token to prevent infinite loops when reading collections");
+        sb.AppendLine("                reader.Skip();");
         sb.AppendLine("                return default;");
         sb.AppendLine("            }");
         sb.AppendLine();
@@ -2860,6 +2864,8 @@ private static void GenerateRootDictionaryRead(StringBuilder sb, ITypeSymbol dic
 
         sb.AppendLine("            if (reader.TokenType != YamlTokenType.MappingStart)");
         sb.AppendLine("            {");
+        sb.AppendLine("                // Skip unexpected token to prevent infinite loops when reading collections");
+        sb.AppendLine("                reader.Skip();");
         sb.AppendLine("                return default;");
         sb.AppendLine("            }");
         sb.AppendLine();

src/Yamlify/Reader/Utf8YamlReader.cs

@@ -587,6 +587,13 @@ public void Skip()
                 // Keep reading until we exit the current depth
             }
         }
+        else if (_tokenType is YamlTokenType.Scalar)
+        {
+            // For scalar values (including nulls like ~, null, Null, NULL), just advance to the next token
+            Read();
+        }
+        // For other tokens (end markers, etc.), do nothing - they're structural tokens
+        // that don't need to be skipped
     }
 }