Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Upgrade to SnakeYAML 2.0

Browse Source 
This commit raises the SnakeYAML baseline version to 2.0.
While most Spring applications are not affected by CVE-2022-1471,
upgrading this version should prevent automated tools from raising this
as a security issue. Such tools usually do not understand that YAML
parsing in Spring is about reading configuration, not parsing untrusted
content.

Closes gh-30048
This commit is contained in:
Andrey Somov
2023-05-22 14:31:27 +02:00
committed by Brian Clozel
parent 96a429a561
commit 097758baf3
3 changed files with 14 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
spring-beans/src/main/java/org/springframework/beans/factory/config/YamlProcessor.java
View File

@@ -34,6 +34,8 @@ import org.yaml.snakeyaml.DumperOptions;
import org.yaml.snakeyaml.LoaderOptions;
import org.yaml.snakeyaml.Yaml;
import org.yaml.snakeyaml.constructor.Constructor;
import org.yaml.snakeyaml.inspector.TagInspector;
import org.yaml.snakeyaml.nodes.Tag;
import org.yaml.snakeyaml.reader.UnicodeReader;
import org.yaml.snakeyaml.representer.Representer;
@@ -184,8 +186,9 @@ public abstract class YamlProcessor {
protected Yaml createYaml() {
LoaderOptions loaderOptions = new LoaderOptions();
loaderOptions.setAllowDuplicateKeys(false);
loaderOptions.setTagInspector(new SupportedTagInspector());
DumperOptions dumperOptions = new DumperOptions();
return new Yaml(new FilteringConstructor(loaderOptions), new Representer(dumperOptions),
return new Yaml(new Constructor(loaderOptions), new Representer(dumperOptions),
dumperOptions, loaderOptions);
}
@@ -425,23 +428,11 @@ public abstract class YamlProcessor {
FIRST_FOUND
}
/**
* {@link Constructor} that supports filtering of unsupported types.
* <p>If an unsupported type is encountered in a YAML document, an
* {@link IllegalStateException} will be thrown from {@link #getClassForName}.
*/
private class FilteringConstructor extends Constructor {
FilteringConstructor(LoaderOptions loaderOptions) {
super(loaderOptions);
}
private class SupportedTagInspector implements TagInspector {
@Override
protected Class<?> getClassForName(String name) throws ClassNotFoundException {
Assert.state(YamlProcessor.this.supportedTypes.contains(name),
() -> "Unsupported type encountered in YAML document: " + name);
return super.getClassForName(name);
public boolean isGlobalTagAllowed(Tag tag) {
return supportedTypes.contains(tag.getClassName());
}
}