oscerd opened a new pull request, #142: URL: https://github.com/apache/camel-kit/pull/142
Closes #139. Parses YAML frontmatter with `new Yaml(new SafeConstructor(new LoaderOptions()))` in `VersionResolver` and `CveParser` (knowledge/indexer). The default `new Yaml()` uses SnakeYAML's full `Constructor`, which can instantiate arbitrary types via explicit global tags (`!!type`). The frontmatter here is plain data (maps/lists/scalars), so `SafeConstructor` is sufficient and removes that surface. This is build-time, trusted-input hardening (the indexer runs over Apache/RH build-of-Camel docs); not an end-user-reachable vulnerability. Tested: `VersionResolverTest` (12), `CveParserTest` (4), `CveEnrichmentTest` (22) all pass; `-Psourcecheck validate` clean. _AI-generated by Claude Code (Claude Opus 4.8) on behalf of @oscerd._ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
