Node aliases result in duplicate objects

[NathanZook]

    s := `
--- 
- &a
  - 1
  - 2
  - 42
- *a
`
    b := []byte(s)
    var y [][]int
    err = yaml.Unmarshal(b, &y)
    if err != nil {
      fmt.Printf("Err: %v", err)
    }
    y[0][1] = 54
    fmt.Printf("%v\n", y)

[[1 54 42] [1 2 42]]

This is the root behind kubernetes/kubernetes#83253 (CVE-2019-11253), which went into #515. It may also be why #632 is triggering the limit added there.

It also means that structures containing loops cannot be handled. In particular, the example document at https://github.com/go-yaml/yaml/blob/v3/scannerc.go#L178 fails to Unmarshal.

I certainly agree that if untrusted inputs are to be fed to Unmarshal, that some sort of breaker is required.

As I read the YAML document at https://yaml.org/spec/1.2/spec.html#id2760395, it is actually required that node aliases not create new object, but only references to the original.