Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Upgrade to SnakeYAML 2.0

Browse Source 
This commit raises the SnakeYAML baseline version to 2.0.
While most Spring applications are not affected by CVE-2022-1471,
upgrading this version should prevent automated tools from raising this
as a security issue. Such tools usually do not understand that YAML
parsing in Spring is about reading configuration, not parsing untrusted
content.

Closes gh-30048
This commit is contained in:
Andrey Somov
2023-05-22 14:31:27 +02:00
committed by Brian Clozel
parent 96a429a561
commit 097758baf3
3 changed files with 14 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
spring-beans/src/test/java/org/springframework/beans/factory/config/YamlProcessorTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -24,7 +24,7 @@ import java.util.Map;
import java.util.Set;
import org.junit.jupiter.api.Test;
import org.yaml.snakeyaml.constructor.ConstructorException;
import org.yaml.snakeyaml.composer.ComposerException;
import org.yaml.snakeyaml.parser.ParserException;
import org.yaml.snakeyaml.scanner.ScannerException;
@@ -156,9 +156,9 @@ class YamlProcessorTests {
void customTypeNotSupportedByDefault() throws Exception {
URL url = new URL("https://localhost:9000/");
setYaml("value: !!java.net.URL [\"" + url + "\"]");
assertThatExceptionOfType(ConstructorException.class)
assertThatExceptionOfType(ComposerException.class)
.isThrownBy(() -> this.processor.process((properties, map) -> {}))
.withMessageContaining("Unsupported type encountered in YAML document: java.net.URL");
.withMessageContaining("Global tag is not allowed: tag:yaml.org,2002:java.net.URL");
}
@Test
@@ -180,9 +180,9 @@ class YamlProcessorTests {
setYaml("value: !!java.net.URL [\"https://localhost:9000/\"]");
assertThatExceptionOfType(ConstructorException.class)
assertThatExceptionOfType(ComposerException.class)
.isThrownBy(() -> this.processor.process((properties, map) -> {}))
.withMessageContaining("Unsupported type encountered in YAML document: java.net.URL");
.withMessageContaining("Global tag is not allowed: tag:yaml.org,2002:java.net.URL");
}
private void setYaml(String yaml) {